{
  "statistics": {
    "processing": [
      {
        "name": "CAPE",
        "time": 0.0
      },
      {
        "name": "AnalysisInfo",
        "time": 0.017
      },
      {
        "name": "BehaviorAnalysis",
        "time": 0.004
      },
      {
        "name": "Debug",
        "time": 0.001
      },
      {
        "name": "NetworkAnalysis",
        "time": 1.17
      },
      {
        "name": "UrlAnalysis",
        "time": 1.704
      },
      {
        "name": "script_log_processing",
        "time": 0.001
      },
      {
        "name": "ProcessMemory",
        "time": 0.0
      }
    ],
    "signatures": [
      {
        "name": "packer_themida",
        "time": 0.0
      },
      {
        "name": "stealth_network",
        "time": 0.0
      },
      {
        "name": "disable_driver_via_blocklist",
        "time": 0.0
      },
      {
        "name": "disable_driver_via_hvcidisallowedimages",
        "time": 0.0
      },
      {
        "name": "disable_hypervisor_protected_code_integrity",
        "time": 0.0
      },
      {
        "name": "pendingfilerenameoperations_Operations",
        "time": 0.0
      },
      {
        "name": "anomalous_deletefile",
        "time": 0.0
      },
      {
        "name": "antiav_servicestop",
        "time": 0.0
      },
      {
        "name": "antidebug_guardpages",
        "time": 0.0
      },
      {
        "name": "antidebug_outputdebugstring",
        "time": 0.0
      },
      {
        "name": "antidebug_windows",
        "time": 0.0
      },
      {
        "name": "antisandbox_cuckoocrash",
        "time": 0.0
      },
      {
        "name": "antisandbox_foregroundwindows",
        "time": 0.0
      },
      {
        "name": "mouse_movement_detect",
        "time": 0.0
      },
      {
        "name": "antisandbox_script_timer",
        "time": 0.0
      },
      {
        "name": "antisandbox_sleep",
        "time": 0.0
      },
      {
        "name": "antisandbox_unhook",
        "time": 0.0
      },
      {
        "name": "hardware_id_profiling",
        "time": 0.0
      },
      {
        "name": "antivm_directory_objects",
        "time": 0.0
      },
      {
        "name": "antivm_display",
        "time": 0.0
      },
      {
        "name": "antivm_generic_disk",
        "time": 0.0
      },
      {
        "name": "antivm_generic_system",
        "time": 0.0
      },
      {
        "name": "antivm_checks_available_memory",
        "time": 0.0
      },
      {
        "name": "detect_virtualization_via_recent_files",
        "time": 0.0
      },
      {
        "name": "antivm_vmware_events",
        "time": 0.0
      },
      {
        "name": "antivm_wmi",
        "time": 0.0
      },
      {
        "name": "api_spamming",
        "time": 0.0
      },
      {
        "name": "api_uuidfromstringa",
        "time": 0.0
      },
      {
        "name": "bcdedit_command",
        "time": 0.0
      },
      {
        "name": "bootkit",
        "time": 0.0
      },
      {
        "name": "direct_hdd_access",
        "time": 0.0
      },
      {
        "name": "physical_drive_access",
        "time": 0.0
      },
      {
        "name": "potential_overwrite_mbr",
        "time": 0.0
      },
      {
        "name": "read_file_raw_disk_access",
        "time": 0.0
      },
      {
        "name": "suspicious_iocontrol_codes",
        "time": 0.0
      },
      {
        "name": "browser_needed",
        "time": 0.0
      },
      {
        "name": "amsi_enumeration",
        "time": 0.0
      },
      {
        "name": "suspicious_ntdll_disk_load",
        "time": 0.0
      },
      {
        "name": "direct_syscall_evasion",
        "time": 0.0
      },
      {
        "name": "unbacked_syscall_execution",
        "time": 0.0
      },
      {
        "name": "uac_bypass_cmstp",
        "time": 0.0
      },
      {
        "name": "uac_bypass_eventvwr",
        "time": 0.0
      },
      {
        "name": "uac_bypass_windows_Backup",
        "time": 0.0
      },
      {
        "name": "privilege_elevation_check",
        "time": 0.0
      },
      {
        "name": "queries_computer_name",
        "time": 0.0
      },
      {
        "name": "queries_user_name",
        "time": 0.0
      },
      {
        "name": "creates_largekey",
        "time": 0.0
      },
      {
        "name": "creates_nullvalue",
        "time": 0.0
      },
      {
        "name": "access_windows_passwords_vault",
        "time": 0.0
      },
      {
        "name": "lsass_credential_dumping",
        "time": 0.0
      },
      {
        "name": "critical_process",
        "time": 0.0
      },
      {
        "name": "query_fips_reconnaissance",
        "time": 0.0
      },
      {
        "name": "cryptopool_domains",
        "time": 0.0
      },
      {
        "name": "dead_connect",
        "time": 0.0
      },
      {
        "name": "dead_link",
        "time": 0.0
      },
      {
        "name": "debugs_self",
        "time": 0.0
      },
      {
        "name": "decoy_image",
        "time": 0.0
      },
      {
        "name": "deletes_consolehost_history",
        "time": 0.0
      },
      {
        "name": "deletes_shadow_copies",
        "time": 0.0
      },
      {
        "name": "deletes_system_state_backup",
        "time": 0.0
      },
      {
        "name": "dep_bypass",
        "time": 0.0
      },
      {
        "name": "dep_disable",
        "time": 0.0
      },
      {
        "name": "disables_mappeddrives_autodisconnect",
        "time": 0.0
      },
      {
        "name": "disables_wfp",
        "time": 0.0
      },
      {
        "name": "add_windows_defender_exclusions",
        "time": 0.0
      },
      {
        "name": "mountpoints_volume_discovery",
        "time": 0.0
      },
      {
        "name": "dllload_suspicious_directory",
        "time": 0.0
      },
      {
        "name": "document_script_exe_drop",
        "time": 0.0
      },
      {
        "name": "driver_load",
        "time": 0.0
      },
      {
        "name": "install_kernel_driver_service",
        "time": 0.0
      },
      {
        "name": "malformed_dll_loading",
        "time": 0.0
      },
      {
        "name": "dynamic_function_loading",
        "time": 0.0
      },
      {
        "name": "registers_vectored_exception_handler",
        "time": 0.0
      },
      {
        "name": "process_creation_suspicious_location",
        "time": 0.0
      },
      {
        "name": "exploit_getbasekerneladdress",
        "time": 0.0
      },
      {
        "name": "exploit_gethaldispatchtable",
        "time": 0.0
      },
      {
        "name": "exploit_heapspray",
        "time": 0.0
      },
      {
        "name": "downloads_from_filehosting",
        "time": 0.0
      },
      {
        "name": "generic_phish",
        "time": 0.0
      },
      {
        "name": "http_request",
        "time": 0.0
      },
      {
        "name": "infostealer_browser",
        "time": 0.0
      },
      {
        "name": "infostealer_browser_password",
        "time": 0.0
      },
      {
        "name": "infostealer_cookies",
        "time": 0.0
      },
      {
        "name": "captures_screenshot",
        "time": 0.0
      },
      {
        "name": "injection_createremotethread",
        "time": 0.0
      },
      {
        "name": "creates_suspended_process",
        "time": 0.0
      },
      {
        "name": "injection_module_stomping_probing",
        "time": 0.0
      },
      {
        "name": "injection_needextension",
        "time": 0.0
      },
      {
        "name": "injection_network_traffic",
        "time": 0.0
      },
      {
        "name": "injection_runpe",
        "time": 0.0
      },
      {
        "name": "section_mapping_injection",
        "time": 0.0
      },
      {
        "name": "injection_themeinitapihook",
        "time": 0.0
      },
      {
        "name": "apc_injection",
        "time": 0.0
      },
      {
        "name": "resumethread_remote_process",
        "time": 0.0
      },
      {
        "name": "injection_write_exe_process",
        "time": 0.0
      },
      {
        "name": "injection_write_process",
        "time": 0.0
      },
      {
        "name": "internet_dropper",
        "time": 0.0
      },
      {
        "name": "interprocess_comms_mutex",
        "time": 0.0
      },
      {
        "name": "interprocess_comms_named_pipe",
        "time": 0.0
      },
      {
        "name": "interprocess_comms_shared_memory",
        "time": 0.0
      },
      {
        "name": "escalate_privilege_via_named_pipe",
        "time": 0.0
      },
      {
        "name": "ipc_namedpipe",
        "time": 0.0
      },
      {
        "name": "js_phish",
        "time": 0.0
      },
      {
        "name": "js_suspicious_redirect",
        "time": 0.0
      },
      {
        "name": "execute_binary_via_internet_explorer_exporter",
        "time": 0.0
      },
      {
        "name": "execute_binary_via_run_exe_helper_utility",
        "time": 0.0
      },
      {
        "name": "execute_ps_via_syncappvpublishingserver",
        "time": 0.0
      },
      {
        "name": "malicious_dynamic_function_loading",
        "time": 0.0
      },
      {
        "name": "reads_memory_remote_process",
        "time": 0.0
      },
      {
        "name": "unbacked_exception_filter",
        "time": 0.0
      },
      {
        "name": "unbacked_process_mitigation_alteration",
        "time": 0.0
      },
      {
        "name": "thread_unbacked_memory",
        "time": 0.0
      },
      {
        "name": "unbacked_api_resolution",
        "time": 0.0
      },
      {
        "name": "unbacked_dotnet_execution",
        "time": 0.0
      },
      {
        "name": "unbacked_library_load",
        "time": 0.0
      },
      {
        "name": "unbacked_memory_apc_execution",
        "time": 0.0
      },
      {
        "name": "unbacked_memory_protection_alteration",
        "time": 0.0
      },
      {
        "name": "unbacked_mutex_creation",
        "time": 0.0
      },
      {
        "name": "unbacked_process_creation",
        "time": 0.0
      },
      {
        "name": "unbacked_veh_registration",
        "time": 0.0
      },
      {
        "name": "unbacked_com_instantiation",
        "time": 0.0
      },
      {
        "name": "unbacked_crypto_operations",
        "time": 0.0
      },
      {
        "name": "unbacked_delay_execution",
        "time": 0.0
      },
      {
        "name": "unbacked_file_dropping",
        "time": 0.0
      },
      {
        "name": "unbacked_process_enumeration",
        "time": 0.0
      },
      {
        "name": "unbacked_registry_modification",
        "time": 0.0
      },
      {
        "name": "unbacked_service_manipulation",
        "time": 0.0
      },
      {
        "name": "unbacked_token_manipulation",
        "time": 0.0
      },
      {
        "name": "unbacked_wmi_execution",
        "time": 0.0
      },
      {
        "name": "unbacked_bind_shell",
        "time": 0.0
      },
      {
        "name": "unbacked_dns_resolution",
        "time": 0.0
      },
      {
        "name": "unbacked_memory_network_connection",
        "time": 0.0
      },
      {
        "name": "unbacked_named_pipe_creation",
        "time": 0.0
      },
      {
        "name": "unbacked_useragent_retrieval",
        "time": 0.0
      },
      {
        "name": "mimics_filetime",
        "time": 0.0
      },
      {
        "name": "amsi_bypass_via_com_registry",
        "time": 0.0
      },
      {
        "name": "access_auto_logons_via_registry",
        "time": 0.0
      },
      {
        "name": "access_boot_key_via_registry",
        "time": 0.0
      },
      {
        "name": "create_suspicious_lnk_files",
        "time": 0.0
      },
      {
        "name": "credential_access_via_windows_credential_history",
        "time": 0.0
      },
      {
        "name": "dll_hijacking_via_microsoft_exchange",
        "time": 0.0
      },
      {
        "name": "dll_hijacking_via_waas_medic_svc_com_typelib",
        "time": 0.0
      },
      {
        "name": "execute_file_downloaded_via_openssh",
        "time": 0.0
      },
      {
        "name": "execute_safe_mode_from_suspicious_process",
        "time": 0.0
      },
      {
        "name": "execute_scripts_via_microsoft_management_console",
        "time": 0.0
      },
      {
        "name": "execute_suspicious_processes_via_windows_mssql_service",
        "time": 0.0
      },
      {
        "name": "execution_from_self_extracting_archive",
        "time": 0.0
      },
      {
        "name": "ip_address_discovery_via_trusted_program",
        "time": 0.0
      },
      {
        "name": "load_dll_via_control_panel",
        "time": 0.0
      },
      {
        "name": "network_connection_via_suspicious_process",
        "time": 0.0
      },
      {
        "name": "potential_location_discovery_via_unusual_process",
        "time": 0.0
      },
      {
        "name": "store_executable_registry",
        "time": 0.0
      },
      {
        "name": "Suspicious_Execution_Via_MicrosoftExchangeTransportAgent",
        "time": 0.0
      },
      {
        "name": "suspicious_java_execution_via_win_scripts",
        "time": 0.0
      },
      {
        "name": "Suspicious_Scheduled_Task_Creation_Via_Masqueraded_XML_File",
        "time": 0.0
      },
      {
        "name": "uses_restart_manager_for_suspicious_activities",
        "time": 0.0
      },
      {
        "name": "modify_desktop_wallpaper",
        "time": 0.0
      },
      {
        "name": "move_file_on_reboot",
        "time": 0.0
      },
      {
        "name": "multiple_useragents",
        "time": 0.0
      },
      {
        "name": "network_anomaly",
        "time": 0.0
      },
      {
        "name": "network_bind",
        "time": 0.0
      },
      {
        "name": "etherhiding_smart_contract_call",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_archive",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_free_webhosting",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_generic",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_interactsh",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_opensource",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_pastesite",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_payload",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_serviceinterface",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_socialmedia",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_telegram",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_tempstorage",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_temp_urldns",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_urlshortener",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_useragent",
        "time": 0.0
      },
      {
        "name": "network_cnc_smtps_exfil",
        "time": 0.0
      },
      {
        "name": "network_cnc_smtps_generic",
        "time": 0.0
      },
      {
        "name": "network_dns_idn",
        "time": 0.0
      },
      {
        "name": "network_dns_suspicious_querytype",
        "time": 0.0
      },
      {
        "name": "network_dns_tunneling_request",
        "time": 0.0
      },
      {
        "name": "explorer_http",
        "time": 0.0
      },
      {
        "name": "network_fake_useragent",
        "time": 0.0
      },
      {
        "name": "legitimate_domain_abuse",
        "time": 0.0
      },
      {
        "name": "suspicious_communication_trusted_site",
        "time": 0.0
      },
      {
        "name": "network_tor",
        "time": 0.0
      },
      {
        "name": "office_cve2017_11882_network",
        "time": 0.0
      },
      {
        "name": "office_cve_2021_40444",
        "time": 0.0
      },
      {
        "name": "office_cve_2021_40444_m2",
        "time": 0.0
      },
      {
        "name": "office_flash_load",
        "time": 0.0
      },
      {
        "name": "office_postscript",
        "time": 0.0
      },
      {
        "name": "office_suspicious_processes",
        "time": 0.0
      },
      {
        "name": "decompress_exe",
        "time": 0.0
      },
      {
        "name": "persistence_via_autodial_dll_registry",
        "time": 0.0
      },
      {
        "name": "persistence_autorun",
        "time": 0.0
      },
      {
        "name": "persistence_autorun_tasks",
        "time": 0.0
      },
      {
        "name": "persistence_bootexecute",
        "time": 0.0
      },
      {
        "name": "persistence_registry_script",
        "time": 0.0
      },
      {
        "name": "powershell_download",
        "time": 0.0
      },
      {
        "name": "powershell_request",
        "time": 0.0
      },
      {
        "name": "createtoolhelp32snapshot_module_enumeration",
        "time": 0.0
      },
      {
        "name": "enumerates_running_processes",
        "time": 0.0
      },
      {
        "name": "process_interest",
        "time": 0.0
      },
      {
        "name": "process_needed",
        "time": 0.0
      },
      {
        "name": "ransomware_iocp_asynchronous_encryption",
        "time": 0.0
      },
      {
        "name": "kernel_crypto_driver_abuse",
        "time": 0.0
      },
      {
        "name": "mass_data_encryption",
        "time": 0.0
      },
      {
        "name": "ransomware_extension_hijack",
        "time": 0.0
      },
      {
        "name": "mass_file_modification_access",
        "time": 0.0
      },
      {
        "name": "ransomware_attribute_stripping",
        "time": 0.0
      },
      {
        "name": "ransomware_file_modifications",
        "time": 0.0
      },
      {
        "name": "mass_ransom_note_drop",
        "time": 0.0
      },
      {
        "name": "ransomware_message",
        "time": 0.0
      },
      {
        "name": "recon_beacon",
        "time": 0.0
      },
      {
        "name": "recon_programs",
        "time": 0.0
      },
      {
        "name": "recon_systeminfo",
        "time": 0.0
      },
      {
        "name": "accesses_recyclebin",
        "time": 0.0
      },
      {
        "name": "script_created_process",
        "time": 0.0
      },
      {
        "name": "script_network_activity",
        "time": 0.0
      },
      {
        "name": "suspicious_js_script",
        "time": 0.0
      },
      {
        "name": "javascript_timer",
        "time": 0.0
      },
      {
        "name": "secure_login_phishing",
        "time": 0.0
      },
      {
        "name": "securityxploded_modules",
        "time": 0.0
      },
      {
        "name": "get_clipboard_data",
        "time": 0.0
      },
      {
        "name": "sets_autoconfig_url",
        "time": 0.0
      },
      {
        "name": "spoofs_procname",
        "time": 0.0
      },
      {
        "name": "stack_pivot",
        "time": 0.0
      },
      {
        "name": "stack_pivot_file_created",
        "time": 0.0
      },
      {
        "name": "stack_pivot_process_create",
        "time": 0.0
      },
      {
        "name": "set_clipboard_data",
        "time": 0.0
      },
      {
        "name": "stealth_childproc",
        "time": 0.0
      },
      {
        "name": "stealth_system_procname",
        "time": 0.0
      },
      {
        "name": "stealth_window",
        "time": 0.0
      },
      {
        "name": "queries_keyboard_layout",
        "time": 0.0
      },
      {
        "name": "queries_locale_api",
        "time": 0.0
      },
      {
        "name": "terminates_remote_process",
        "time": 0.0
      },
      {
        "name": "user_enum",
        "time": 0.0
      },
      {
        "name": "virus",
        "time": 0.0
      },
      {
        "name": "webmail_phish",
        "time": 0.0
      },
      {
        "name": "persists_dev_util",
        "time": 0.0
      },
      {
        "name": "spawns_dev_util",
        "time": 0.0
      },
      {
        "name": "alters_windows_utility",
        "time": 0.0
      },
      {
        "name": "overwrites_accessibility_utility",
        "time": 0.0
      },
      {
        "name": "Potential_Lateral_Movement_Via_SMBEXEC",
        "time": 0.0
      },
      {
        "name": "potential_WebShell_Via_ScreenConnectServer",
        "time": 0.0
      },
      {
        "name": "uses_Microsoft_HTML_Help_Executable",
        "time": 0.0
      },
      {
        "name": "wiper_zeroedbytes",
        "time": 0.0
      },
      {
        "name": "wmi_create_process",
        "time": 0.0
      },
      {
        "name": "wmi_script_process",
        "time": 0.0
      },
      {
        "name": "deletes_files",
        "time": 0.0
      },
      {
        "name": "drops_files",
        "time": 0.0
      },
      {
        "name": "reads_files",
        "time": 0.0
      },
      {
        "name": "writes_files",
        "time": 0.0
      },
      {
        "name": "antianalysis_tls_section",
        "time": 0.0
      },
      {
        "name": "antivirus_clamav",
        "time": 0.0
      },
      {
        "name": "antivirus_virustotal",
        "time": 0.0
      },
      {
        "name": "bad_certs",
        "time": 0.0
      },
      {
        "name": "bad_ssl_certs",
        "time": 0.0
      },
      {
        "name": "banker_zeus_p2p",
        "time": 0.0
      },
      {
        "name": "banker_zeus_url",
        "time": 0.0
      },
      {
        "name": "bot_athenahttp",
        "time": 0.0
      },
      {
        "name": "bot_dirtjumper",
        "time": 0.0
      },
      {
        "name": "bot_drive",
        "time": 0.0
      },
      {
        "name": "bot_drive2",
        "time": 0.0
      },
      {
        "name": "bot_madness",
        "time": 0.0
      },
      {
        "name": "byod_loldrivers_match",
        "time": 0.0
      },
      {
        "name": "byod_novel_driver",
        "time": 0.0
      },
      {
        "name": "byod_post_load_exploitation",
        "time": 0.0
      },
      {
        "name": "byod_driver_service_install",
        "time": 0.0
      },
      {
        "name": "com_spawned_process",
        "time": 0.0
      },
      {
        "name": "family_proxyback",
        "time": 0.0
      },
      {
        "name": "flare_capa_antianalysis",
        "time": 0.0
      },
      {
        "name": "flare_capa_collection",
        "time": 0.0
      },
      {
        "name": "flare_capa_communication",
        "time": 0.0
      },
      {
        "name": "flare_capa_compiler",
        "time": 0.0
      },
      {
        "name": "flare_capa_datamanipulation",
        "time": 0.0
      },
      {
        "name": "flare_capa_executable",
        "time": 0.0
      },
      {
        "name": "flare_capa_hostinteraction",
        "time": 0.0
      },
      {
        "name": "flare_capa_impact",
        "time": 0.0
      },
      {
        "name": "flare_capa_lib",
        "time": 0.0
      },
      {
        "name": "flare_capa_linking",
        "time": 0.0
      },
      {
        "name": "flare_capa_loadcode",
        "time": 0.0
      },
      {
        "name": "flare_capa_malwarefamily",
        "time": 0.0
      },
      {
        "name": "flare_capa_nursery",
        "time": 0.0
      },
      {
        "name": "flare_capa_persistence",
        "time": 0.0
      },
      {
        "name": "flare_capa_runtime",
        "time": 0.0
      },
      {
        "name": "flare_capa_targeting",
        "time": 0.0
      },
      {
        "name": "threatfox",
        "time": 0.0
      },
      {
        "name": "log4shell",
        "time": 0.0
      },
      {
        "name": "mimics_extension",
        "time": 0.0
      },
      {
        "name": "network_ip_exe",
        "time": 0.0
      },
      {
        "name": "network_dga",
        "time": 0.0
      },
      {
        "name": "network_dga_fraunhofer",
        "time": 0.0
      },
      {
        "name": "network_dyndns",
        "time": 0.001
      },
      {
        "name": "network_icmp",
        "time": 0.0
      },
      {
        "name": "network_irc",
        "time": 0.0
      },
      {
        "name": "network_open_proxy",
        "time": 0.0
      },
      {
        "name": "network_smtp",
        "time": 0.0
      },
      {
        "name": "network_torgateway",
        "time": 0.0
      },
      {
        "name": "origin_langid",
        "time": 0.0
      },
      {
        "name": "origin_resource_langid",
        "time": 0.0
      },
      {
        "name": "overlay",
        "time": 0.0
      },
      {
        "name": "pe_deep_entrypoint",
        "time": 0.0
      },
      {
        "name": "packer_unknown_pe_section_name",
        "time": 0.0
      },
      {
        "name": "packer_aspack",
        "time": 0.0
      },
      {
        "name": "packer_aspirecrypt",
        "time": 0.0
      },
      {
        "name": "packer_bedsprotector",
        "time": 0.0
      },
      {
        "name": "packer_confuser",
        "time": 0.0
      },
      {
        "name": "packer_enigma",
        "time": 0.0
      },
      {
        "name": "packer_entropy",
        "time": 0.0
      },
      {
        "name": "packer_mpress",
        "time": 0.0
      },
      {
        "name": "packer_nate",
        "time": 0.0
      },
      {
        "name": "packer_nspack",
        "time": 0.0
      },
      {
        "name": "packer_smartassembly",
        "time": 0.0
      },
      {
        "name": "packer_spices",
        "time": 0.0
      },
      {
        "name": "packer_themida",
        "time": 0.0
      },
      {
        "name": "packer_titan",
        "time": 0.0
      },
      {
        "name": "packer_upx",
        "time": 0.0
      },
      {
        "name": "packer_vmprotect",
        "time": 0.0
      },
      {
        "name": "packer_yoda",
        "time": 0.0
      },
      {
        "name": "pe_cert_invalid_signature",
        "time": 0.0
      },
      {
        "name": "pe_cert_self_signed",
        "time": 0.0
      },
      {
        "name": "pe_cert_suspicious_issuer",
        "time": 0.0
      },
      {
        "name": "punch_plus_plus_pcres",
        "time": 0.0
      },
      {
        "name": "procmem_yara",
        "time": 0.0
      },
      {
        "name": "recon_checkip",
        "time": 0.0
      },
      {
        "name": "sigma_events",
        "time": 0.0
      },
      {
        "name": "static_authenticode",
        "time": 0.0
      },
      {
        "name": "invalid_authenticode_signature",
        "time": 0.0
      },
      {
        "name": "static_dotnet_anomaly",
        "time": 0.0
      },
      {
        "name": "static_java",
        "time": 0.0
      },
      {
        "name": "static_pdf",
        "time": 0.0
      },
      {
        "name": "contains_pe_overlay",
        "time": 0.0
      },
      {
        "name": "static_pe_anomaly",
        "time": 0.0
      },
      {
        "name": "pe_compile_timestomping",
        "time": 0.0
      },
      {
        "name": "static_pe_pdbpath",
        "time": 0.0
      },
      {
        "name": "static_rat_config",
        "time": 0.0
      },
      {
        "name": "static_versioninfo_anomaly",
        "time": 0.0
      },
      {
        "name": "browser_credential_theft_headless",
        "time": 0.0
      },
      {
        "name": "suricata_alert",
        "time": 0.0
      },
      {
        "name": "volatility_devicetree_1",
        "time": 0.0
      },
      {
        "name": "volatility_handles_1",
        "time": 0.0
      },
      {
        "name": "volatility_ldrmodules_1",
        "time": 0.0
      },
      {
        "name": "volatility_ldrmodules_2",
        "time": 0.0
      },
      {
        "name": "volatility_malfind_1",
        "time": 0.0
      },
      {
        "name": "volatility_malfind_2",
        "time": 0.0
      },
      {
        "name": "volatility_modscan_1",
        "time": 0.0
      },
      {
        "name": "volatility_svcscan_1",
        "time": 0.0
      },
      {
        "name": "volatility_svcscan_2",
        "time": 0.0
      },
      {
        "name": "volatility_svcscan_3",
        "time": 0.0
      },
      {
        "name": "whois_create",
        "time": 0.0
      },
      {
        "name": "accesses_mailslot",
        "time": 0.0
      },
      {
        "name": "accesses_netlogon_regkey",
        "time": 0.0
      },
      {
        "name": "accesses_public_folder",
        "time": 0.0
      },
      {
        "name": "accesses_sysvol",
        "time": 0.0
      },
      {
        "name": "writes_sysvol",
        "time": 0.0
      },
      {
        "name": "adds_admin_user",
        "time": 0.0
      },
      {
        "name": "adds_user",
        "time": 0.0
      },
      {
        "name": "overwrites_admin_password",
        "time": 0.0
      },
      {
        "name": "antianalysis_detectfile",
        "time": 0.001
      },
      {
        "name": "antianalysis_detectreg",
        "time": 0.0
      },
      {
        "name": "modify_attachment_manager",
        "time": 0.0
      },
      {
        "name": "antiav_detectfile",
        "time": 0.001
      },
      {
        "name": "antiav_detectreg",
        "time": 0.001
      },
      {
        "name": "antiav_srp",
        "time": 0.0
      },
      {
        "name": "antiav_whitespace",
        "time": 0.0
      },
      {
        "name": "antidebug_devices",
        "time": 0.0
      },
      {
        "name": "antiemu_windefend",
        "time": 0.0
      },
      {
        "name": "antiemu_wine_reg",
        "time": 0.0
      },
      {
        "name": "antisandbox_cuckoo_files",
        "time": 0.0
      },
      {
        "name": "antisandbox_fortinet_files",
        "time": 0.0
      },
      {
        "name": "antisandbox_joe_anubis_files",
        "time": 0.0
      },
      {
        "name": "antisandbox_sboxie_mutex",
        "time": 0.0
      },
      {
        "name": "antisandbox_sunbelt_files",
        "time": 0.0
      },
      {
        "name": "antisandbox_threattrack_files",
        "time": 0.0
      },
      {
        "name": "antivm_bochs_keys",
        "time": 0.0
      },
      {
        "name": "antivm_generic_bios",
        "time": 0.0
      },
      {
        "name": "antivm_generic_diskreg",
        "time": 0.0
      },
      {
        "name": "antivm_hyperv_keys",
        "time": 0.0
      },
      {
        "name": "antivm_parallels_keys",
        "time": 0.0
      },
      {
        "name": "antivm_recentdocs",
        "time": 0.0
      },
      {
        "name": "antivm_vbox_devices",
        "time": 0.0
      },
      {
        "name": "antivm_vbox_files",
        "time": 0.0
      },
      {
        "name": "antivm_vbox_keys",
        "time": 0.0
      },
      {
        "name": "antivm_vmware_devices",
        "time": 0.0
      },
      {
        "name": "antivm_vmware_files",
        "time": 0.0
      },
      {
        "name": "antivm_vmware_keys",
        "time": 0.0
      },
      {
        "name": "antivm_vmware_mutexes",
        "time": 0.0
      },
      {
        "name": "antivm_vpc_files",
        "time": 0.0
      },
      {
        "name": "antivm_vpc_keys",
        "time": 0.0
      },
      {
        "name": "antivm_vpc_mutex",
        "time": 0.0
      },
      {
        "name": "antivm_xen_keys",
        "time": 0.0
      },
      {
        "name": "ketrican_regkeys",
        "time": 0.0
      },
      {
        "name": "bitcoin_opencl",
        "time": 0.0
      },
      {
        "name": "enumerates_physical_drives",
        "time": 0.0
      },
      {
        "name": "bot_russkill",
        "time": 0.0
      },
      {
        "name": "browser_addon",
        "time": 0.0
      },
      {
        "name": "chromium_browser_extension_directory",
        "time": 0.0
      },
      {
        "name": "browser_helper_object",
        "time": 0.0
      },
      {
        "name": "browser_security",
        "time": 0.0
      },
      {
        "name": "browser_startpage",
        "time": 0.0
      },
      {
        "name": "executes_headless_browser",
        "time": 0.0
      },
      {
        "name": "suspicious_browser_arguments",
        "time": 0.0
      },
      {
        "name": "ie_disables_process_tab",
        "time": 0.0
      },
      {
        "name": "odbcconf_bypass",
        "time": 0.001
      },
      {
        "name": "squiblydoo_bypass",
        "time": 0.0
      },
      {
        "name": "squiblytwo_bypass",
        "time": 0.0
      },
      {
        "name": "bypass_chromium_protection",
        "time": 0.0
      },
      {
        "name": "bypass_firewall",
        "time": 0.0
      },
      {
        "name": "checks_uac_status",
        "time": 0.0
      },
      {
        "name": "uac_bypass_cmstpcom",
        "time": 0.0
      },
      {
        "name": "uac_bypass_delegateexecute_sdclt",
        "time": 0.0
      },
      {
        "name": "uac_bypass_fodhelper",
        "time": 0.0
      },
      {
        "name": "cape_extracted_content",
        "time": 0.0
      },
      {
        "name": "clears_logs",
        "time": 0.0
      },
      {
        "name": "cmdline_obfuscation",
        "time": 0.0
      },
      {
        "name": "cmdline_switches",
        "time": 0.0
      },
      {
        "name": "cmdline_terminate",
        "time": 0.0
      },
      {
        "name": "cmdline_forfiles_wildcard",
        "time": 0.0
      },
      {
        "name": "cmdline_http_link",
        "time": 0.0
      },
      {
        "name": "cmdline_long_string",
        "time": 0.0
      },
      {
        "name": "cmdline_reversed_http_link",
        "time": 0.0
      },
      {
        "name": "long_commandline",
        "time": 0.0
      },
      {
        "name": "powershell_renamed_commandline",
        "time": 0.0
      },
      {
        "name": "copies_self",
        "time": 0.0
      },
      {
        "name": "credwiz_credentialaccess",
        "time": 0.0
      },
      {
        "name": "enables_wdigest",
        "time": 0.0
      },
      {
        "name": "vaultcmd_credentialaccess",
        "time": 0.0
      },
      {
        "name": "file_credential_store_access",
        "time": 0.0
      },
      {
        "name": "file_credential_store_write",
        "time": 0.0
      },
      {
        "name": "kerberos_credential_access_via_rubeus",
        "time": 0.0
      },
      {
        "name": "registry_credential_dumping",
        "time": 0.0
      },
      {
        "name": "registry_lsa_secrets_access",
        "time": 0.0
      },
      {
        "name": "comsvcs_credentialdump",
        "time": 0.0
      },
      {
        "name": "cryptomining_stratum_command",
        "time": 0.0
      },
      {
        "name": "deepfreeze_mutex",
        "time": 0.0
      },
      {
        "name": "deletes_executed_files",
        "time": 0.0
      },
      {
        "name": "disables_app_launch",
        "time": 0.0
      },
      {
        "name": "disables_auto_app_termination",
        "time": 0.0
      },
      {
        "name": "disables_appv_virtualization",
        "time": 0.0
      },
      {
        "name": "disables_backups",
        "time": 0.0
      },
      {
        "name": "disables_browser_warn",
        "time": 0.0
      },
      {
        "name": "disables_context_menus",
        "time": 0.0
      },
      {
        "name": "disables_cpl_disable",
        "time": 0.0
      },
      {
        "name": "disables_crashdumps",
        "time": 0.0
      },
      {
        "name": "disables_event_logging",
        "time": 0.0
      },
      {
        "name": "disables_folder_options",
        "time": 0.0
      },
      {
        "name": "disables_notificationcenter",
        "time": 0.0
      },
      {
        "name": "disables_power_options",
        "time": 0.0
      },
      {
        "name": "disables_restore_default_state",
        "time": 0.0
      },
      {
        "name": "disables_run_command",
        "time": 0.0
      },
      {
        "name": "disables_smartscreen",
        "time": 0.0
      },
      {
        "name": "disables_startmenu_search",
        "time": 0.0
      },
      {
        "name": "disables_system_restore",
        "time": 0.0
      },
      {
        "name": "disables_uac",
        "time": 0.0
      },
      {
        "name": "disables_wer",
        "time": 0.0
      },
      {
        "name": "disables_windows_defender",
        "time": 0.0
      },
      {
        "name": "disables_windows_defender_logging",
        "time": 0.001
      },
      {
        "name": "removes_windows_defender_contextmenu",
        "time": 0.001
      },
      {
        "name": "removes_windows_defender_updates",
        "time": 0.0
      },
      {
        "name": "windows_defender_powershell",
        "time": 0.0
      },
      {
        "name": "disables_windows_file_protection",
        "time": 0.0
      },
      {
        "name": "disables_windowsupdate",
        "time": 0.0
      },
      {
        "name": "disables_winfirewall",
        "time": 0.0
      },
      {
        "name": "folder_enumeration",
        "time": 0.0
      },
      {
        "name": "discover_registry_mount_points",
        "time": 0.0
      },
      {
        "name": "adfind_domain_enumeration",
        "time": 0.0
      },
      {
        "name": "domain_enumeration_commands",
        "time": 0.0
      },
      {
        "name": "driver_filtermanager",
        "time": 0.0
      },
      {
        "name": "dropper",
        "time": 0.0
      },
      {
        "name": "dll_archive_execution",
        "time": 0.0
      },
      {
        "name": "lnk_archive_execution",
        "time": 0.0
      },
      {
        "name": "script_archive_execution",
        "time": 0.0
      },
      {
        "name": "excel4_macro_urls",
        "time": 0.0
      },
      {
        "name": "escalate_privilege_via_ntlm_relay",
        "time": 0.0
      },
      {
        "name": "spooler_access",
        "time": 0.0
      },
      {
        "name": "spooler_svc_start",
        "time": 0.0
      },
      {
        "name": "mapped_drives_uac",
        "time": 0.0
      },
      {
        "name": "hides_recycle_bin_icon",
        "time": 0.0
      },
      {
        "name": "infostealer_bitcoin",
        "time": 0.001
      },
      {
        "name": "infostealer_ftp",
        "time": 0.001
      },
      {
        "name": "infostealer_im",
        "time": 0.0
      },
      {
        "name": "infostealer_mail",
        "time": 0.0
      },
      {
        "name": "Evade_Execution_Via_ASPNet_Compiler",
        "time": 0.0
      },
      {
        "name": "Evade_Execute_Via_DeviceCredentialDeployment",
        "time": 0.0
      },
      {
        "name": "Evade_Execution_Via_Filter_Manager_Control",
        "time": 0.0
      },
      {
        "name": "Evade_Execution_Via_Intel_GFXDownloadWrapper",
        "time": 0.0
      },
      {
        "name": "execute_binary_via_appvlp",
        "time": 0.0
      },
      {
        "name": "execute_binary_via_pcalua",
        "time": 0.0
      },
      {
        "name": "Execute_Binary_Via_OpenSSH",
        "time": 0.0
      },
      {
        "name": "execute_binary_via_pcalua",
        "time": 0.0
      },
      {
        "name": "Execute_Binary_Via_PesterPSModule",
        "time": 0.0
      },
      {
        "name": "Execute_Binary_Via_ScriptRunner",
        "time": 0.0
      },
      {
        "name": "execute_binary_via_ttdinject",
        "time": 0.0
      },
      {
        "name": "Execute_Binary_Via_VisualStudioLiveShare",
        "time": 0.0
      },
      {
        "name": "Execute_Msiexec_Via_Explorer",
        "time": 0.0
      },
      {
        "name": "execute_remote_msi",
        "time": 0.0
      },
      {
        "name": "execute_suspicious_powershell_via_runscripthelper",
        "time": 0.0
      },
      {
        "name": "execute_suspicious_powershell_via_sqlps",
        "time": 0.0
      },
      {
        "name": "Indirect_Command_Execution_Via_ConsoleWindowHost",
        "time": 0.0
      },
      {
        "name": "Perform_Malicious_Activities_Via_Headless_Browser",
        "time": 0.0
      },
      {
        "name": "Register_DLL_Via_CertOC",
        "time": 0.0
      },
      {
        "name": "Register_DLL_Via_MSIEXEC",
        "time": 0.0
      },
      {
        "name": "Register_DLL_Via_Odbcconf",
        "time": 0.0
      },
      {
        "name": "Scriptlet_Proxy_Execution_Via_Pubprn",
        "time": 0.0
      },
      {
        "name": "ie_martian_children",
        "time": 0.0
      },
      {
        "name": "office_martian_children",
        "time": 0.0
      },
      {
        "name": "mimics_icon",
        "time": 0.0
      },
      {
        "name": "masquerade_process_name",
        "time": 0.0
      },
      {
        "name": "mimikatz_modules",
        "time": 0.0
      },
      {
        "name": "ms_office_cmd_rce",
        "time": 0.0
      },
      {
        "name": "mount_copy_to_webdav_share",
        "time": 0.0
      },
      {
        "name": "potential_protocol_tunneling_via_legit_utilities",
        "time": 0.0
      },
      {
        "name": "potential_protocol_tunneling_via_qemu",
        "time": 0.0
      },
      {
        "name": "suspicious_execution_via_dotnet_remoting",
        "time": 0.0
      },
      {
        "name": "dotnet_clr_usagelog_regkeys",
        "time": 0.0
      },
      {
        "name": "modify_hostfile",
        "time": 0.0
      },
      {
        "name": "modify_oem_information",
        "time": 0.0
      },
      {
        "name": "modify_security_center_warnings",
        "time": 0.0
      },
      {
        "name": "modify_uac_prompt",
        "time": 0.0
      },
      {
        "name": "network_dns_blockchain",
        "time": 0.0
      },
      {
        "name": "network_dns_opennic",
        "time": 0.0
      },
      {
        "name": "network_dns_paste_site",
        "time": 0.0
      },
      {
        "name": "network_dns_reverse_proxy",
        "time": 0.0
      },
      {
        "name": "network_dns_temp_file_storage",
        "time": 0.0
      },
      {
        "name": "network_dns_temp_urldns",
        "time": 0.0
      },
      {
        "name": "network_dns_url_shortener",
        "time": 0.003
      },
      {
        "name": "network_dns_doh_tls",
        "time": 0.0
      },
      {
        "name": "suspicious_tld",
        "time": 0.002
      },
      {
        "name": "network_tor_service",
        "time": 0.0
      },
      {
        "name": "office_code_page",
        "time": 0.0
      },
      {
        "name": "office_addinloading",
        "time": 0.0
      },
      {
        "name": "office_perfkey",
        "time": 0.0
      },
      {
        "name": "office_macro",
        "time": 0.0
      },
      {
        "name": "changes_trust_center_settings",
        "time": 0.0
      },
      {
        "name": "disables_vba_trust_access",
        "time": 0.0
      },
      {
        "name": "office_macro_autoexecution",
        "time": 0.0
      },
      {
        "name": "office_macro_ioc",
        "time": 0.0
      },
      {
        "name": "office_macro_malicious_prediction",
        "time": 0.0
      },
      {
        "name": "office_macro_suspicious",
        "time": 0.0
      },
      {
        "name": "rtf_aslr_bypass",
        "time": 0.0
      },
      {
        "name": "rtf_anomaly_characterset",
        "time": 0.0
      },
      {
        "name": "rtf_anomaly_version",
        "time": 0.0
      },
      {
        "name": "rtf_embedded_content",
        "time": 0.0
      },
      {
        "name": "rtf_embedded_office_file",
        "time": 0.0
      },
      {
        "name": "rtf_exploit_static",
        "time": 0.0
      },
      {
        "name": "office_security",
        "time": 0.0
      },
      {
        "name": "accesses_office_username",
        "time": 0.0
      },
      {
        "name": "office_anomalous_feature",
        "time": 0.0
      },
      {
        "name": "office_dde_command",
        "time": 0.0
      },
      {
        "name": "packer_armadillo_mutex",
        "time": 0.0
      },
      {
        "name": "packer_armadillo_regkey",
        "time": 0.0
      },
      {
        "name": "persistence_ads",
        "time": 0.0
      },
      {
        "name": "persistence_safeboot",
        "time": 0.0
      },
      {
        "name": "persistence_ifeo",
        "time": 0.0
      },
      {
        "name": "persistence_silent_process_exit",
        "time": 0.0
      },
      {
        "name": "persistence_rdp_registry",
        "time": 0.0
      },
      {
        "name": "persistence_rdp_shadowing",
        "time": 0.0
      },
      {
        "name": "persistence_service",
        "time": 0.0
      },
      {
        "name": "persistence_shim_database",
        "time": 0.0
      },
      {
        "name": "powershell_scriptblock_logging",
        "time": 0.0
      },
      {
        "name": "powershell_command_suspicious",
        "time": 0.0
      },
      {
        "name": "powershell_history_save_mod",
        "time": 0.0
      },
      {
        "name": "powershell_renamed",
        "time": 0.0
      },
      {
        "name": "powershell_reversed",
        "time": 0.0
      },
      {
        "name": "powershell_variable_obfuscation",
        "time": 0.0
      },
      {
        "name": "prevents_safeboot",
        "time": 0.0
      },
      {
        "name": "cmdline_process_discovery",
        "time": 0.0
      },
      {
        "name": "ransomware_extensions_generic",
        "time": 0.0
      },
      {
        "name": "ransomware_extensions_known",
        "time": 0.001
      },
      {
        "name": "ransomware_files",
        "time": 0.002
      },
      {
        "name": "ransomware_recyclebin",
        "time": 0.0
      },
      {
        "name": "ransomware_revil_regkey",
        "time": 0.0
      },
      {
        "name": "reads_password_database",
        "time": 0.0
      },
      {
        "name": "recon_fingerprint",
        "time": 0.0
      },
      {
        "name": "rdptcp_key",
        "time": 0.0
      },
      {
        "name": "uses_rdp_clip",
        "time": 0.0
      },
      {
        "name": "uses_remote_desktop_session",
        "time": 0.0
      },
      {
        "name": "removes_networking_icon",
        "time": 0.0
      },
      {
        "name": "removes_pinned_programs",
        "time": 0.0
      },
      {
        "name": "removes_security_maintenance_icon",
        "time": 0.0
      },
      {
        "name": "removes_startmenu_defaults",
        "time": 0.0
      },
      {
        "name": "removes_username_startmenu",
        "time": 0.0
      },
      {
        "name": "sniffer_winpcap",
        "time": 0.0
      },
      {
        "name": "spreading_autoruninf",
        "time": 0.0
      },
      {
        "name": "stealth_hidden_extension",
        "time": 0.0
      },
      {
        "name": "stealth_hiddenreg",
        "time": 0.0
      },
      {
        "name": "stealth_hide_notifications",
        "time": 0.0
      },
      {
        "name": "stealth_webhistory",
        "time": 0.0
      },
      {
        "name": "sysinternals_psexec",
        "time": 0.0
      },
      {
        "name": "sysinternals_tools",
        "time": 0.0
      },
      {
        "name": "language_check_registry",
        "time": 0.0
      },
      {
        "name": "tampers_etw",
        "time": 0.0
      },
      {
        "name": "lsa_tampering",
        "time": 0.0
      },
      {
        "name": "tampers_powershell_logging",
        "time": 0.0
      },
      {
        "name": "territorial_disputes_sigs",
        "time": 0.001
      },
      {
        "name": "uses_adfind",
        "time": 0.0
      },
      {
        "name": "uses_ms_protocol",
        "time": 0.0
      },
      {
        "name": "owa_web_shell_files",
        "time": 0.0
      },
      {
        "name": "web_shell_files",
        "time": 0.0
      },
      {
        "name": "web_shell_processes",
        "time": 0.0
      },
      {
        "name": "dotnet_csc_build",
        "time": 0.0
      },
      {
        "name": "mavinject_lolbin",
        "time": 0.0
      },
      {
        "name": "multiple_explorer_instances",
        "time": 0.0
      },
      {
        "name": "script_tool_executed",
        "time": 0.0
      },
      {
        "name": "suspicious_certutil_use",
        "time": 0.0
      },
      {
        "name": "suspicious_command_tools",
        "time": 0.004
      },
      {
        "name": "suspicious_mpcmdrun_use",
        "time": 0.0
      },
      {
        "name": "suspicious_ping_use",
        "time": 0.0
      },
      {
        "name": "uses_powershell_copyitem",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities",
        "time": 0.004
      },
      {
        "name": "uses_windows_utilities_appcmd",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_csvde_ldifde",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_cipher",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_clickonce",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_curl",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_dsquery",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_esentutl",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_finger",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_mode",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_ntdsutil",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_nltest",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_setx",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_xcopy",
        "time": 0.0
      },
      {
        "name": "wmic_command_suspicious",
        "time": 0.0
      },
      {
        "name": "scrcons_wmi_script_consumer",
        "time": 0.0
      }
    ],
    "reporting": [
      {
        "name": "BinGraph",
        "time": 0.0
      }
    ]
  },
  "CAPE": {
    "payloads": [],
    "configs": []
  },
  "info": {
    "version": "2.5",
    "started": "2026-05-28 18:43:32",
    "ended": "2026-05-28 18:44:11",
    "duration": 39,
    "id": 19,
    "category": "url",
    "custom": "",
    "machine": {
      "id": 15,
      "status": "stopping",
      "name": "cuckoo1",
      "label": "cuckoo1",
      "platform": "windows",
      "manager": "KVM",
      "started_on": "2026-05-28 18:43:32",
      "shutdown_on": "2026-05-28 18:44:11"
    },
    "package": "edge",
    "timeout": false,
    "tlp": null,
    "parent_sample": null,
    "options": {
      "interactive": "1",
      "nohuman": "yes",
      "vnc_port": "5910"
    },
    "source_url": null,
    "route": "none",
    "user_id": 1,
    "CAPE_current_commit": "e261551257b77d1ae36b689efcf9b3d0af4476c2"
  },
  "behavior": {
    "processes": [
      {
        "process_id": 4676,
        "process_name": "explorer.exe",
        "parent_id": 4608,
        "module_path": "C:\\Windows\\explorer.exe",
        "first_seen": "2026-05-28 22:43:38,456",
        "calls": [
          {
            "timestamp": "2026-05-28 22:43:41,285",
            "thread_id": "6208",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff96cdef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000026ac"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 0
          },
          {
            "timestamp": "2026-05-28 22:43:41,285",
            "thread_id": "6208",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff97016d2f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000026a4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 1
          },
          {
            "timestamp": "2026-05-28 22:43:41,285",
            "thread_id": "5300",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c232",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00002698"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07df0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x081ef620"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 2
          },
          {
            "timestamp": "2026-05-28 22:43:41,300",
            "thread_id": "5300",
            "caller": "0x7fff7f36d59f",
            "parentcaller": "0x7fff7f3ac80c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001a20"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 3
          },
          {
            "timestamp": "2026-05-28 22:43:41,363",
            "thread_id": "5468",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff9706aff0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000352-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4
          },
          {
            "timestamp": "2026-05-28 22:43:42,566",
            "thread_id": "5468",
            "caller": "0x7fff7f36e842",
            "parentcaller": "0x7fff98cc16e9",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000266c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 5
          },
          {
            "timestamp": "2026-05-28 22:43:50,706",
            "thread_id": "5300",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 6
          },
          {
            "timestamp": "2026-05-28 22:43:50,706",
            "thread_id": "5300",
            "caller": "0x7fff7f36d59f",
            "parentcaller": "0x7fff7f3ac80c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000410"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 7
          }
        ],
        "threads": [
          "6208",
          "5300",
          "5468"
        ],
        "environ": {
          "UserName": "admin",
          "ComputerName": "JOHNS-PC",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\",
          "CommandLine": "C:\\Windows\\Explorer.EXE",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "12bc-0026",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff663980000",
          "MainExeSize": "0x00546000",
          "Bitness": "64-bit"
        },
        "file_activities": {
          "read_files": [],
          "write_files": [],
          "delete_files": []
        }
      },
      {
        "process_id": 6712,
        "process_name": "msedge.exe",
        "parent_id": 4676,
        "module_path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
        "first_seen": "2026-05-28 22:43:50,229",
        "calls": [
          {
            "timestamp": "2026-05-28 22:43:50,307",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\bcryptprimitives"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96c20000"
              }
            ],
            "repeated": 0,
            "id": 0
          },
          {
            "timestamp": "2026-05-28 22:43:50,323",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\version"
              },
              {
                "name": "DllBase",
                "value": "0x7fff853a0000"
              }
            ],
            "repeated": 0,
            "id": 1
          },
          {
            "timestamp": "2026-05-28 22:43:50,323",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\shcore"
              },
              {
                "name": "DllBase",
                "value": "0x7fff984b0000"
              }
            ],
            "repeated": 0,
            "id": 2
          },
          {
            "timestamp": "2026-05-28 22:43:50,323",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\shcore"
              },
              {
                "name": "DllBase",
                "value": "0x7fff984b0000"
              }
            ],
            "repeated": 0,
            "id": 3
          },
          {
            "timestamp": "2026-05-28 22:43:50,323",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\Wldp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95ca0000"
              }
            ],
            "repeated": 0,
            "id": 4
          },
          {
            "timestamp": "2026-05-28 22:43:50,323",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\windows.storage"
              },
              {
                "name": "DllBase",
                "value": "0x7fff94410000"
              }
            ],
            "repeated": 0,
            "id": 5
          },
          {
            "timestamp": "2026-05-28 22:43:50,323",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\SHCORE"
              },
              {
                "name": "DllBase",
                "value": "0x7fff984b0000"
              }
            ],
            "repeated": 0,
            "id": 6
          },
          {
            "timestamp": "2026-05-28 22:43:50,323",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\ntmarta"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95450000"
              }
            ],
            "repeated": 0,
            "id": 7
          },
          {
            "timestamp": "2026-05-28 22:43:50,463",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\WINMM"
              },
              {
                "name": "DllBase",
                "value": "0x7fff84a60000"
              }
            ],
            "repeated": 0,
            "id": 8
          },
          {
            "timestamp": "2026-05-28 22:43:50,463",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge"
              },
              {
                "name": "DllBase",
                "value": "0x7fff3ee40000"
              }
            ],
            "repeated": 0,
            "id": 9
          },
          {
            "timestamp": "2026-05-28 22:43:50,479",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\KBDUS"
              },
              {
                "name": "DllBase",
                "value": "0x7fff833e0000"
              }
            ],
            "repeated": 0,
            "id": 10
          },
          {
            "timestamp": "2026-05-28 22:43:50,479",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\KBDUS"
              },
              {
                "name": "DllBase",
                "value": "0x7fff833e0000"
              }
            ],
            "repeated": 0,
            "id": 11
          },
          {
            "timestamp": "2026-05-28 22:43:50,479",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\uxtheme"
              },
              {
                "name": "DllBase",
                "value": "0x7fff93cf0000"
              }
            ],
            "repeated": 0,
            "id": 12
          },
          {
            "timestamp": "2026-05-28 22:43:50,479",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\kernel.appcore"
              },
              {
                "name": "DllBase",
                "value": "0x7fff94210000"
              }
            ],
            "repeated": 0,
            "id": 13
          },
          {
            "timestamp": "2026-05-28 22:43:50,479",
            "thread_id": "7108",
            "caller": "0x7fff9652c5f2",
            "parentcaller": "0x7fff965289f3",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000370"
              },
              {
                "name": "ThreadHandle",
                "value": "0x0000036c"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=crashpad-handler \"--user-data-dir=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=148.0.7778.180 \"--annotation=exe=C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=148.0.3967.83 --initial-client-data=0x348,0x34c,0x350,0x344,0x358,0x7fff52985d58,0x7fff52985d64,0x7fff52985d70"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "7104"
              }
            ],
            "repeated": 0,
            "id": 14
          },
          {
            "timestamp": "2026-05-28 22:43:50,479",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\clbcatq"
              },
              {
                "name": "DllBase",
                "value": "0x7fff98230000"
              }
            ],
            "repeated": 0,
            "id": 15
          },
          {
            "timestamp": "2026-05-28 22:43:50,479",
            "thread_id": "7108",
            "caller": "0x7fff965289f3",
            "parentcaller": "0x7fff983d7d70",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=crashpad-handler \"--user-data-dir=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=148.0.7778.180 \"--annotation=exe=C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=148.0.3967.83 --initial-client-data=0x348,0x34c,0x350,0x344,0x358,0x7fff52985d58,0x7fff52985d64,0x7fff52985d70"
              },
              {
                "name": "CreationFlags",
                "value": "0x00080000",
                "pretty_value": "EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "7104"
              },
              {
                "name": "ThreadId",
                "value": "6320"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00000370"
              },
              {
                "name": "ThreadHandle",
                "value": "0x0000036c"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16
          },
          {
            "timestamp": "2026-05-28 22:43:50,479",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings"
              },
              {
                "name": "DllBase",
                "value": "0x7fff92010000"
              }
            ],
            "repeated": 0,
            "id": 17
          },
          {
            "timestamp": "2026-05-28 22:43:50,479",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\msvcp110_win"
              },
              {
                "name": "DllBase",
                "value": "0x7fff953c0000"
              }
            ],
            "repeated": 0,
            "id": 18
          },
          {
            "timestamp": "2026-05-28 22:43:50,479",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\policymanager"
              },
              {
                "name": "DllBase",
                "value": "0x7fff90020000"
              }
            ],
            "repeated": 0,
            "id": 19
          },
          {
            "timestamp": "2026-05-28 22:43:50,479",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\policymanager"
              },
              {
                "name": "DllBase",
                "value": "0x7fff90020000"
              }
            ],
            "repeated": 0,
            "id": 20
          },
          {
            "timestamp": "2026-05-28 22:43:50,479",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\msvcp110_win"
              },
              {
                "name": "DllBase",
                "value": "0x7fff953c0000"
              }
            ],
            "repeated": 0,
            "id": 21
          },
          {
            "timestamp": "2026-05-28 22:43:50,495",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\USERENV"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96220000"
              }
            ],
            "repeated": 0,
            "id": 22
          },
          {
            "timestamp": "2026-05-28 22:43:50,495",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\gpapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff94bc0000"
              }
            ],
            "repeated": 0,
            "id": 23
          },
          {
            "timestamp": "2026-05-28 22:43:50,495",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wkscli"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95490000"
              }
            ],
            "repeated": 0,
            "id": 24
          },
          {
            "timestamp": "2026-05-28 22:43:50,495",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\netutils"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95850000"
              }
            ],
            "repeated": 0,
            "id": 25
          },
          {
            "timestamp": "2026-05-28 22:43:50,495",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\msvcp110_win"
              },
              {
                "name": "DllBase",
                "value": "0x7fff953c0000"
              }
            ],
            "repeated": 0,
            "id": 26
          },
          {
            "timestamp": "2026-05-28 22:43:50,495",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\MDMRegistration"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8c000000"
              }
            ],
            "repeated": 0,
            "id": 27
          },
          {
            "timestamp": "2026-05-28 22:43:50,495",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\powrprof"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96190000"
              }
            ],
            "repeated": 0,
            "id": 28
          },
          {
            "timestamp": "2026-05-28 22:43:50,495",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\CRYPTSP"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95bf0000"
              }
            ],
            "repeated": 0,
            "id": 29
          },
          {
            "timestamp": "2026-05-28 22:43:50,495",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\ncrypt"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95d10000"
              }
            ],
            "repeated": 0,
            "id": 30
          },
          {
            "timestamp": "2026-05-28 22:43:50,495",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\imagehlp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff98560000"
              }
            ],
            "repeated": 0,
            "id": 31
          },
          {
            "timestamp": "2026-05-28 22:43:50,495",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\tbs"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8e460000"
              }
            ],
            "repeated": 0,
            "id": 32
          },
          {
            "timestamp": "2026-05-28 22:43:50,495",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DMCmnUtils"
              },
              {
                "name": "DllBase",
                "value": "0x7fff82660000"
              }
            ],
            "repeated": 0,
            "id": 33
          },
          {
            "timestamp": "2026-05-28 22:43:50,495",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\omadmapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8bfc0000"
              }
            ],
            "repeated": 0,
            "id": 34
          },
          {
            "timestamp": "2026-05-28 22:43:50,495",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\UMPDC"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96170000"
              }
            ],
            "repeated": 0,
            "id": 35
          },
          {
            "timestamp": "2026-05-28 22:43:50,495",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\NTASN1"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95cd0000"
              }
            ],
            "repeated": 0,
            "id": 36
          },
          {
            "timestamp": "2026-05-28 22:43:50,495",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\MDMRegistration"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8c000000"
              }
            ],
            "repeated": 0,
            "id": 37
          },
          {
            "timestamp": "2026-05-28 22:43:50,495",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\omadmapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8bfc0000"
              }
            ],
            "repeated": 0,
            "id": 38
          },
          {
            "timestamp": "2026-05-28 22:43:50,495",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\msvcp110_win"
              },
              {
                "name": "DllBase",
                "value": "0x7fff953c0000"
              }
            ],
            "repeated": 0,
            "id": 39
          },
          {
            "timestamp": "2026-05-28 22:43:50,495",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\powrprof"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96190000"
              }
            ],
            "repeated": 0,
            "id": 40
          },
          {
            "timestamp": "2026-05-28 22:43:50,495",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\UMPDC"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96170000"
              }
            ],
            "repeated": 0,
            "id": 41
          },
          {
            "timestamp": "2026-05-28 22:43:50,495",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DMCmnUtils"
              },
              {
                "name": "DllBase",
                "value": "0x7fff82660000"
              }
            ],
            "repeated": 0,
            "id": 42
          },
          {
            "timestamp": "2026-05-28 22:43:50,495",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\CRYPTSP"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95bf0000"
              }
            ],
            "repeated": 0,
            "id": 43
          },
          {
            "timestamp": "2026-05-28 22:43:50,495",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\ncrypt"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95d10000"
              }
            ],
            "repeated": 0,
            "id": 44
          },
          {
            "timestamp": "2026-05-28 22:43:50,495",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\NTASN1"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95cd0000"
              }
            ],
            "repeated": 0,
            "id": 45
          },
          {
            "timestamp": "2026-05-28 22:43:50,495",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\tbs"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8e460000"
              }
            ],
            "repeated": 0,
            "id": 46
          },
          {
            "timestamp": "2026-05-28 22:43:50,495",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\imagehlp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff98560000"
              }
            ],
            "repeated": 0,
            "id": 47
          },
          {
            "timestamp": "2026-05-28 22:43:50,495",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\netapi32"
              },
              {
                "name": "DllBase",
                "value": "0x7fff85400000"
              }
            ],
            "repeated": 0,
            "id": 48
          },
          {
            "timestamp": "2026-05-28 22:43:50,495",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\msvcp110_win"
              },
              {
                "name": "DllBase",
                "value": "0x7fff953c0000"
              }
            ],
            "repeated": 0,
            "id": 49
          },
          {
            "timestamp": "2026-05-28 22:43:50,495",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\cryptsp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95bf0000"
              }
            ],
            "repeated": 0,
            "id": 50
          },
          {
            "timestamp": "2026-05-28 22:43:50,495",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DSREG"
              },
              {
                "name": "DllBase",
                "value": "0x7fff92030000"
              }
            ],
            "repeated": 0,
            "id": 51
          },
          {
            "timestamp": "2026-05-28 22:43:50,495",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\profapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96260000"
              }
            ],
            "repeated": 0,
            "id": 52
          },
          {
            "timestamp": "2026-05-28 22:43:50,510",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\netapi32"
              },
              {
                "name": "DllBase",
                "value": "0x7fff85400000"
              }
            ],
            "repeated": 0,
            "id": 53
          },
          {
            "timestamp": "2026-05-28 22:43:50,510",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DSREG"
              },
              {
                "name": "DllBase",
                "value": "0x7fff92030000"
              }
            ],
            "repeated": 0,
            "id": 54
          },
          {
            "timestamp": "2026-05-28 22:43:50,510",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\msvcp110_win"
              },
              {
                "name": "DllBase",
                "value": "0x7fff953c0000"
              }
            ],
            "repeated": 0,
            "id": 55
          },
          {
            "timestamp": "2026-05-28 22:43:50,510",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\cryptsp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95bf0000"
              }
            ],
            "repeated": 0,
            "id": 56
          },
          {
            "timestamp": "2026-05-28 22:43:50,510",
            "thread_id": "8324",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\AssignedAccessRuntime"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8c050000"
              }
            ],
            "repeated": 0,
            "id": 57
          },
          {
            "timestamp": "2026-05-28 22:43:50,510",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\MSCTF"
              },
              {
                "name": "DllBase",
                "value": "0x7fff97f00000"
              }
            ],
            "repeated": 0,
            "id": 58
          },
          {
            "timestamp": "2026-05-28 22:43:50,510",
            "thread_id": "8324",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\SystemSettings.DataModel"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8cef0000"
              }
            ],
            "repeated": 0,
            "id": 59
          },
          {
            "timestamp": "2026-05-28 22:43:50,510",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\powrprof"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96190000"
              }
            ],
            "repeated": 0,
            "id": 60
          },
          {
            "timestamp": "2026-05-28 22:43:50,510",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\UMPDC"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96170000"
              }
            ],
            "repeated": 0,
            "id": 61
          },
          {
            "timestamp": "2026-05-28 22:43:50,510",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DWrite"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8a140000"
              }
            ],
            "repeated": 0,
            "id": 62
          },
          {
            "timestamp": "2026-05-28 22:43:50,510",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\\COMCTL32"
              },
              {
                "name": "DllBase",
                "value": "0x7fff82ed0000"
              }
            ],
            "repeated": 0,
            "id": 63
          },
          {
            "timestamp": "2026-05-28 22:43:50,510",
            "thread_id": "8372",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8f850000"
              }
            ],
            "repeated": 0,
            "id": 64
          },
          {
            "timestamp": "2026-05-28 22:43:50,510",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DPAPI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff960b0000"
              }
            ],
            "repeated": 0,
            "id": 65
          },
          {
            "timestamp": "2026-05-28 22:43:50,526",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\IPHLPAPI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff956f0000"
              }
            ],
            "repeated": 0,
            "id": 66
          },
          {
            "timestamp": "2026-05-28 22:43:50,526",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\NLAapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff91940000"
              }
            ],
            "repeated": 0,
            "id": 67
          },
          {
            "timestamp": "2026-05-28 22:43:50,526",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\NSI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff98020000"
              }
            ],
            "repeated": 0,
            "id": 68
          },
          {
            "timestamp": "2026-05-28 22:43:50,526",
            "thread_id": "8320",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\CFGMGR32"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96af0000"
              }
            ],
            "repeated": 0,
            "id": 69
          },
          {
            "timestamp": "2026-05-28 22:43:50,526",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\dhcpcsvc6"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8ead0000"
              }
            ],
            "repeated": 0,
            "id": 70
          },
          {
            "timestamp": "2026-05-28 22:43:50,526",
            "thread_id": "8680",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\StructuredQuery"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8beb0000"
              }
            ],
            "repeated": 0,
            "id": 71
          },
          {
            "timestamp": "2026-05-28 22:43:50,526",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\dhcpcsvc"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8eab0000"
              }
            ],
            "repeated": 0,
            "id": 72
          },
          {
            "timestamp": "2026-05-28 22:43:50,526",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DNSAPI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95730000"
              }
            ],
            "repeated": 0,
            "id": 73
          },
          {
            "timestamp": "2026-05-28 22:43:50,526",
            "thread_id": "8680",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\PROPSYS"
              },
              {
                "name": "DllBase",
                "value": "0x7fff91eb0000"
              }
            ],
            "repeated": 0,
            "id": 74
          },
          {
            "timestamp": "2026-05-28 22:43:50,526",
            "thread_id": "2560",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.StateRepositoryPS"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8b820000"
              }
            ],
            "repeated": 0,
            "id": 75
          },
          {
            "timestamp": "2026-05-28 22:43:50,526",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\CoreMessaging"
              },
              {
                "name": "DllBase",
                "value": "0x7fff93840000"
              }
            ],
            "repeated": 0,
            "id": 76
          },
          {
            "timestamp": "2026-05-28 22:43:50,526",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wintypes"
              },
              {
                "name": "DllBase",
                "value": "0x7fff92180000"
              }
            ],
            "repeated": 0,
            "id": 77
          },
          {
            "timestamp": "2026-05-28 22:43:50,526",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\CoreUIComponents"
              },
              {
                "name": "DllBase",
                "value": "0x7fff93160000"
              }
            ],
            "repeated": 0,
            "id": 78
          },
          {
            "timestamp": "2026-05-28 22:43:50,526",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\textinputframework"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8a6e0000"
              }
            ],
            "repeated": 0,
            "id": 79
          },
          {
            "timestamp": "2026-05-28 22:43:50,526",
            "thread_id": "8680",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\Windows.Storage.Search"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8b750000"
              }
            ],
            "repeated": 0,
            "id": 80
          },
          {
            "timestamp": "2026-05-28 22:43:50,542",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\twinapi.appcore"
              },
              {
                "name": "DllBase",
                "value": "0x7fff90da0000"
              }
            ],
            "repeated": 0,
            "id": 81
          },
          {
            "timestamp": "2026-05-28 22:43:50,542",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\twinapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff82bc0000"
              }
            ],
            "repeated": 0,
            "id": 82
          },
          {
            "timestamp": "2026-05-28 22:43:50,542",
            "thread_id": "2560",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\mssprxy"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8a550000"
              }
            ],
            "repeated": 0,
            "id": 83
          },
          {
            "timestamp": "2026-05-28 22:43:50,542",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wevtapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff905b0000"
              }
            ],
            "repeated": 0,
            "id": 84
          },
          {
            "timestamp": "2026-05-28 22:43:50,542",
            "thread_id": "8372",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\edputil"
              },
              {
                "name": "DllBase",
                "value": "0x7fff86740000"
              }
            ],
            "repeated": 0,
            "id": 85
          },
          {
            "timestamp": "2026-05-28 22:43:50,542",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\WindowManagementAPI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff90fb0000"
              }
            ],
            "repeated": 0,
            "id": 86
          },
          {
            "timestamp": "2026-05-28 22:43:50,542",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\InputHost"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8a580000"
              }
            ],
            "repeated": 0,
            "id": 87
          },
          {
            "timestamp": "2026-05-28 22:43:50,542",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.UI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8a7e0000"
              }
            ],
            "repeated": 0,
            "id": 88
          },
          {
            "timestamp": "2026-05-28 22:43:50,542",
            "thread_id": "2596",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\WTSAPI32"
              },
              {
                "name": "DllBase",
                "value": "0x7fff91fe0000"
              }
            ],
            "repeated": 0,
            "id": 89
          },
          {
            "timestamp": "2026-05-28 22:43:50,542",
            "thread_id": "8324",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\iertutil"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8c3b0000"
              }
            ],
            "repeated": 0,
            "id": 90
          },
          {
            "timestamp": "2026-05-28 22:43:50,557",
            "thread_id": "8324",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.Web"
              },
              {
                "name": "DllBase",
                "value": "0x7fff865d0000"
              }
            ],
            "repeated": 0,
            "id": 91
          },
          {
            "timestamp": "2026-05-28 22:43:50,557",
            "thread_id": "2596",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\WINSTA"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95ff0000"
              }
            ],
            "repeated": 0,
            "id": 92
          },
          {
            "timestamp": "2026-05-28 22:43:50,557",
            "thread_id": "7880",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\ColorAdapterClient"
              },
              {
                "name": "DllBase",
                "value": "0x7fff90620000"
              }
            ],
            "repeated": 0,
            "id": 93
          },
          {
            "timestamp": "2026-05-28 22:43:50,557",
            "thread_id": "7880",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\mscms"
              },
              {
                "name": "DllBase",
                "value": "0x7fff90660000"
              }
            ],
            "repeated": 0,
            "id": 94
          },
          {
            "timestamp": "2026-05-28 22:43:50,557",
            "thread_id": "8324",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\WINHTTP"
              },
              {
                "name": "DllBase",
                "value": "0x7fff90780000"
              }
            ],
            "repeated": 0,
            "id": 95
          },
          {
            "timestamp": "2026-05-28 22:43:50,573",
            "thread_id": "8364",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\oneauth"
              },
              {
                "name": "DllBase",
                "value": "0x7fff3d4e0000"
              }
            ],
            "repeated": 0,
            "id": 96
          },
          {
            "timestamp": "2026-05-28 22:43:50,573",
            "thread_id": "8512",
            "caller": "0x7fff9652c5f2",
            "parentcaller": "0x7fff96529666",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000a0c"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000a08"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=2448,i,8680256655390085944,14781426459881126139,524288 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2560 /prefetch:3"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "1392"
              }
            ],
            "repeated": 0,
            "id": 97
          },
          {
            "timestamp": "2026-05-28 22:43:50,573",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.UI.Immersive"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8a3c0000"
              }
            ],
            "repeated": 0,
            "id": 98
          },
          {
            "timestamp": "2026-05-28 22:43:50,573",
            "thread_id": "8512",
            "caller": "0x7fff96529666",
            "parentcaller": "0x7fff98b6cec4",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": ""
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=2448,i,8680256655390085944,14781426459881126139,524288 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2560 /prefetch:3"
              },
              {
                "name": "CreationFlags",
                "value": "0x00080000",
                "pretty_value": "EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "1392"
              },
              {
                "name": "ThreadId",
                "value": "8888"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00000a0c"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000a08"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 99
          },
          {
            "timestamp": "2026-05-28 22:43:50,573",
            "thread_id": "8364",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\Secur32"
              },
              {
                "name": "DllBase",
                "value": "0x7fff87320000"
              }
            ],
            "repeated": 0,
            "id": 100
          },
          {
            "timestamp": "2026-05-28 22:43:50,588",
            "thread_id": "8324",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000a24"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000a50"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2180,i,153934363376628892,4001203935498138754,262144 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2356 /prefetch:2"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "9044"
              }
            ],
            "repeated": 0,
            "id": 101
          },
          {
            "timestamp": "2026-05-28 22:43:50,588",
            "thread_id": "8324",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2180,i,153934363376628892,4001203935498138754,262144 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2356 /prefetch:2"
              },
              {
                "name": "CreationFlags",
                "value": "0x0008040c",
                "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "9044"
              },
              {
                "name": "ThreadId",
                "value": "1704"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00000a24"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000a50"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 102
          },
          {
            "timestamp": "2026-05-28 22:43:50,588",
            "thread_id": "8924",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000b4c"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000b48"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2752,i,15663351803793895304,5259456288936133186,524288 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2732 /prefetch:8"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "8452"
              }
            ],
            "repeated": 0,
            "id": 103
          },
          {
            "timestamp": "2026-05-28 22:43:50,588",
            "thread_id": "8312",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\sxs"
              },
              {
                "name": "DllBase",
                "value": "0x7fff960c0000"
              }
            ],
            "repeated": 0,
            "id": 104
          },
          {
            "timestamp": "2026-05-28 22:43:50,604",
            "thread_id": "7880",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\LINKINFO"
              },
              {
                "name": "DllBase",
                "value": "0x7fff853f0000"
              }
            ],
            "repeated": 0,
            "id": 105
          },
          {
            "timestamp": "2026-05-28 22:43:50,604",
            "thread_id": "8312",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\usermgrcli"
              },
              {
                "name": "DllBase",
                "value": "0x7fff916b0000"
              }
            ],
            "repeated": 0,
            "id": 106
          },
          {
            "timestamp": "2026-05-28 22:43:50,604",
            "thread_id": "8924",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2752,i,15663351803793895304,5259456288936133186,524288 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2732 /prefetch:8"
              },
              {
                "name": "CreationFlags",
                "value": "0x0008040c",
                "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "8452"
              },
              {
                "name": "ThreadId",
                "value": "1900"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00000b4c"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000b48"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 107
          },
          {
            "timestamp": "2026-05-28 22:43:50,604",
            "thread_id": "8312",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.Internal.UI.Shell.WindowTabManager"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7ddc0000"
              }
            ],
            "repeated": 0,
            "id": 108
          },
          {
            "timestamp": "2026-05-28 22:43:50,635",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\dxgi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff94bf0000"
              }
            ],
            "repeated": 0,
            "id": 109
          },
          {
            "timestamp": "2026-05-28 22:43:50,635",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\d3d11"
              },
              {
                "name": "DllBase",
                "value": "0x7fff92740000"
              }
            ],
            "repeated": 0,
            "id": 110
          },
          {
            "timestamp": "2026-05-28 22:43:50,635",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\dcomp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff929b0000"
              }
            ],
            "repeated": 0,
            "id": 111
          },
          {
            "timestamp": "2026-05-28 22:43:50,635",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\dataexchange"
              },
              {
                "name": "DllBase",
                "value": "0x7fff80590000"
              }
            ],
            "repeated": 0,
            "id": 112
          },
          {
            "timestamp": "2026-05-28 22:43:50,667",
            "thread_id": "8324",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.System.Profile.RetailInfo"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8bf90000"
              }
            ],
            "repeated": 0,
            "id": 113
          },
          {
            "timestamp": "2026-05-28 22:43:50,682",
            "thread_id": "8312",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\dwmapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff93e40000"
              }
            ],
            "repeated": 0,
            "id": 114
          },
          {
            "timestamp": "2026-05-28 22:43:50,682",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\OLEACC"
              },
              {
                "name": "DllBase",
                "value": "0x7fff80840000"
              }
            ],
            "repeated": 0,
            "id": 115
          },
          {
            "timestamp": "2026-05-28 22:43:50,682",
            "thread_id": "8328",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000f04"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000f00"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780008161768189 --launch-time-ticks=68919650 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3564,i,4594470550112387863,14821651032443296262,2097152 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3560 /prefetch:1"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "2976"
              }
            ],
            "repeated": 0,
            "id": 116
          },
          {
            "timestamp": "2026-05-28 22:43:50,682",
            "thread_id": "8324",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000e74"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000e94"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780008161768189 --launch-time-ticks=68921711 --skip-read-main-dll --metrics-shmem-handle=3664,i,17389617875997663512,49637702052645388,2097152 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3772 /prefetch:1"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "4752"
              }
            ],
            "repeated": 0,
            "id": 117
          },
          {
            "timestamp": "2026-05-28 22:43:50,682",
            "thread_id": "5976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\directmanipulation"
              },
              {
                "name": "DllBase",
                "value": "0x7fff877f0000"
              }
            ],
            "repeated": 0,
            "id": 118
          },
          {
            "timestamp": "2026-05-28 22:43:50,682",
            "thread_id": "8328",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780008161768189 --launch-time-ticks=68919650 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3564,i,4594470550112387863,14821651032443296262,2097152 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3560 /prefetch:1"
              },
              {
                "name": "CreationFlags",
                "value": "0x0008040c",
                "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "2976"
              },
              {
                "name": "ThreadId",
                "value": "5228"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00000f04"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000f00"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 119
          },
          {
            "timestamp": "2026-05-28 22:43:50,682",
            "thread_id": "8324",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780008161768189 --launch-time-ticks=68921711 --skip-read-main-dll --metrics-shmem-handle=3664,i,17389617875997663512,49637702052645388,2097152 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3772 /prefetch:1"
              },
              {
                "name": "CreationFlags",
                "value": "0x0008040c",
                "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "4752"
              },
              {
                "name": "ThreadId",
                "value": "4864"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00000e74"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000e94"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 120
          },
          {
            "timestamp": "2026-05-28 22:43:50,792",
            "thread_id": "3236",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Well Known Domains\\1.2.0.0\\well_known_domains"
              },
              {
                "name": "DllBase",
                "value": "0x7fff81570000"
              }
            ],
            "repeated": 0,
            "id": 121
          },
          {
            "timestamp": "2026-05-28 22:43:50,854",
            "thread_id": "8324",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\MSASN1"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95e30000"
              }
            ],
            "repeated": 0,
            "id": 122
          },
          {
            "timestamp": "2026-05-28 22:43:50,854",
            "thread_id": "8324",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\CRYPTSP"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95bf0000"
              }
            ],
            "repeated": 0,
            "id": 123
          },
          {
            "timestamp": "2026-05-28 22:43:50,870",
            "thread_id": "2404",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.Security.Authentication.Web.Core"
              },
              {
                "name": "DllBase",
                "value": "0x7fff84f00000"
              }
            ],
            "repeated": 0,
            "id": 124
          },
          {
            "timestamp": "2026-05-28 22:43:50,870",
            "thread_id": "8324",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\rsaenh"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95330000"
              }
            ],
            "repeated": 0,
            "id": 125
          },
          {
            "timestamp": "2026-05-28 22:43:50,885",
            "thread_id": "2560",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\OneCoreCommonProxyStub"
              },
              {
                "name": "DllBase",
                "value": "0x7fff874d0000"
              }
            ],
            "repeated": 0,
            "id": 126
          },
          {
            "timestamp": "2026-05-28 22:43:50,885",
            "thread_id": "2560",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\vaultcli"
              },
              {
                "name": "DllBase",
                "value": "0x7fff78140000"
              }
            ],
            "repeated": 0,
            "id": 127
          },
          {
            "timestamp": "2026-05-28 22:43:50,901",
            "thread_id": "8320",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\aadWamExtension"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7fd60000"
              }
            ],
            "repeated": 0,
            "id": 128
          },
          {
            "timestamp": "2026-05-28 22:43:50,917",
            "thread_id": "2560",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\MicrosoftAccountWAMExtension"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7fb90000"
              }
            ],
            "repeated": 0,
            "id": 129
          },
          {
            "timestamp": "2026-05-28 22:43:52,010",
            "thread_id": "2544",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\ShellCommonCommonProxyStub"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7cee0000"
              }
            ],
            "repeated": 0,
            "id": 130
          },
          {
            "timestamp": "2026-05-28 22:43:52,510",
            "thread_id": "8324",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\msvcp110_win"
              },
              {
                "name": "DllBase",
                "value": "0x7fff953c0000"
              }
            ],
            "repeated": 0,
            "id": 131
          },
          {
            "timestamp": "2026-05-28 22:43:52,510",
            "thread_id": "8324",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\policymanager"
              },
              {
                "name": "DllBase",
                "value": "0x7fff90020000"
              }
            ],
            "repeated": 0,
            "id": 132
          },
          {
            "timestamp": "2026-05-28 22:43:52,510",
            "thread_id": "8324",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\policymanager"
              },
              {
                "name": "DllBase",
                "value": "0x7fff90020000"
              }
            ],
            "repeated": 0,
            "id": 133
          },
          {
            "timestamp": "2026-05-28 22:43:52,510",
            "thread_id": "8324",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\msvcp110_win"
              },
              {
                "name": "DllBase",
                "value": "0x7fff953c0000"
              }
            ],
            "repeated": 0,
            "id": 134
          },
          {
            "timestamp": "2026-05-28 22:43:54,260",
            "thread_id": "8324",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00001414"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000ed4"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --skip-read-main-dll --metrics-shmem-handle=5084,i,16886526138924156661,5957802428661537419,524288 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3092 /prefetch:8"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "6460"
              }
            ],
            "repeated": 0,
            "id": 135
          },
          {
            "timestamp": "2026-05-28 22:43:54,260",
            "thread_id": "8324",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --skip-read-main-dll --metrics-shmem-handle=5084,i,16886526138924156661,5957802428661537419,524288 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3092 /prefetch:8"
              },
              {
                "name": "CreationFlags",
                "value": "0x0008040c",
                "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "6460"
              },
              {
                "name": "ThreadId",
                "value": "6344"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00001414"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000ed4"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 136
          },
          {
            "timestamp": "2026-05-28 22:43:55,307",
            "thread_id": "8352",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\SETUPAPI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff986e0000"
              }
            ],
            "repeated": 0,
            "id": 137
          },
          {
            "timestamp": "2026-05-28 22:43:55,323",
            "thread_id": "8364",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x000014fc"
              },
              {
                "name": "ThreadHandle",
                "value": "0x000014c0"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=5292,i,1418984789271993110,9507067469212756464,524288 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5324 /prefetch:8"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "8668"
              }
            ],
            "repeated": 0,
            "id": 138
          },
          {
            "timestamp": "2026-05-28 22:43:55,323",
            "thread_id": "2540",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\netprofm"
              },
              {
                "name": "DllBase",
                "value": "0x7fff91760000"
              }
            ],
            "repeated": 0,
            "id": 139
          },
          {
            "timestamp": "2026-05-28 22:43:55,323",
            "thread_id": "8364",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=5292,i,1418984789271993110,9507067469212756464,524288 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5324 /prefetch:8"
              },
              {
                "name": "CreationFlags",
                "value": "0x0008040c",
                "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "8668"
              },
              {
                "name": "ThreadId",
                "value": "9036"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x000014fc"
              },
              {
                "name": "ThreadHandle",
                "value": "0x000014c0"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 140
          },
          {
            "timestamp": "2026-05-28 22:43:55,401",
            "thread_id": "5576",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\telclient"
              },
              {
                "name": "DllBase",
                "value": "0x7fff3a630000"
              }
            ],
            "repeated": 0,
            "id": 141
          },
          {
            "timestamp": "2026-05-28 22:43:55,448",
            "thread_id": "8352",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DEVOBJ"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96050000"
              }
            ],
            "repeated": 0,
            "id": 142
          },
          {
            "timestamp": "2026-05-28 22:43:55,448",
            "thread_id": "8352",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\WINTRUST"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96a80000"
              }
            ],
            "repeated": 0,
            "id": 143
          },
          {
            "timestamp": "2026-05-28 22:43:55,448",
            "thread_id": "2540",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\npmproxy"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8e350000"
              }
            ],
            "repeated": 0,
            "id": 144
          },
          {
            "timestamp": "2026-05-28 22:43:55,448",
            "thread_id": "5576",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\oneds"
              },
              {
                "name": "DllBase",
                "value": "0x7fff39fd0000"
              }
            ],
            "repeated": 0,
            "id": 145
          },
          {
            "timestamp": "2026-05-28 22:43:55,463",
            "thread_id": "8344",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\ffmpeg"
              },
              {
                "name": "DllBase",
                "value": "0x7fff3d070000"
              }
            ],
            "repeated": 0,
            "id": 146
          },
          {
            "timestamp": "2026-05-28 22:43:55,463",
            "thread_id": "8352",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\TenantRestrictionsPlugin"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8bf70000"
              }
            ],
            "repeated": 0,
            "id": 147
          },
          {
            "timestamp": "2026-05-28 22:43:55,463",
            "thread_id": "2540",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\FirewallAPI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff94f50000"
              }
            ],
            "repeated": 0,
            "id": 148
          },
          {
            "timestamp": "2026-05-28 22:43:55,463",
            "thread_id": "2540",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\fwbase"
              },
              {
                "name": "DllBase",
                "value": "0x7fff94f10000"
              }
            ],
            "repeated": 0,
            "id": 149
          },
          {
            "timestamp": "2026-05-28 22:43:55,479",
            "thread_id": "3984",
            "caller": "0x7fff9652c5f2",
            "parentcaller": "0x7fff96529666",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00001648"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00001620"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5452,i,6144736785640467952,18088932084502277173,524288 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5700 /prefetch:8"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "3144"
              }
            ],
            "repeated": 0,
            "id": 150
          },
          {
            "timestamp": "2026-05-28 22:43:55,495",
            "thread_id": "2540",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\microsoft_shell_integration"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7fab0000"
              }
            ],
            "repeated": 0,
            "id": 151
          },
          {
            "timestamp": "2026-05-28 22:43:56,104",
            "thread_id": "2540",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\RMCLIENT"
              },
              {
                "name": "DllBase",
                "value": "0x7fff94110000"
              }
            ],
            "repeated": 0,
            "id": 152
          },
          {
            "timestamp": "2026-05-28 22:43:56,104",
            "thread_id": "2540",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\XmlLite"
              },
              {
                "name": "DllBase",
                "value": "0x7fff91e70000"
              }
            ],
            "repeated": 0,
            "id": 153
          },
          {
            "timestamp": "2026-05-28 22:43:56,104",
            "thread_id": "2540",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\wpnapps"
              },
              {
                "name": "DllBase",
                "value": "0x7fff82770000"
              }
            ],
            "repeated": 0,
            "id": 154
          },
          {
            "timestamp": "2026-05-28 22:43:58,838",
            "thread_id": "3984",
            "caller": "0x7fff9652c5f2",
            "parentcaller": "0x7fff96529666",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\capauthz"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8e6a0000"
              }
            ],
            "repeated": 0,
            "id": 155
          },
          {
            "timestamp": "2026-05-28 22:43:58,854",
            "thread_id": "3984",
            "caller": "0x7fff9652c5f2",
            "parentcaller": "0x7fff96529666",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\windows.staterepositorycore"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8b370000"
              }
            ],
            "repeated": 0,
            "id": 156
          },
          {
            "timestamp": "2026-05-28 22:43:58,854",
            "thread_id": "3984",
            "caller": "0x7fff9652c5f2",
            "parentcaller": "0x7fff96529666",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x000017a0"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00001768"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5452,i,6144736785640467952,18088932084502277173,524288 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5700 /prefetch:8"
              },
              {
                "name": "DllPath",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application;"
              },
              {
                "name": "ProcessId",
                "value": "9356"
              }
            ],
            "repeated": 0,
            "id": 157
          },
          {
            "timestamp": "2026-05-28 22:43:58,870",
            "thread_id": "8352",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wlanapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8e370000"
              }
            ],
            "repeated": 0,
            "id": 158
          },
          {
            "timestamp": "2026-05-28 22:43:58,870",
            "thread_id": "8352",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wlanapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8e370000"
              }
            ],
            "repeated": 0,
            "id": 159
          },
          {
            "timestamp": "2026-05-28 22:43:58,885",
            "thread_id": "8352",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.ApplicationModel"
              },
              {
                "name": "DllBase",
                "value": "0x7fff85060000"
              }
            ],
            "repeated": 0,
            "id": 160
          },
          {
            "timestamp": "2026-05-28 22:43:58,885",
            "thread_id": "8352",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\AppXDeploymentClient"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8ed20000"
              }
            ],
            "repeated": 0,
            "id": 161
          },
          {
            "timestamp": "2026-05-28 22:43:59,026",
            "thread_id": "8344",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\NETAPI32"
              },
              {
                "name": "DllBase",
                "value": "0x7fff85400000"
              }
            ],
            "repeated": 0,
            "id": 162
          },
          {
            "timestamp": "2026-05-28 22:43:59,057",
            "thread_id": "3984",
            "caller": "0x7fff96529666",
            "parentcaller": "0x7fff98b6cec4",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": ""
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5452,i,6144736785640467952,18088932084502277173,524288 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5700 /prefetch:8"
              },
              {
                "name": "CreationFlags",
                "value": "0x00080400",
                "pretty_value": "CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "9356"
              },
              {
                "name": "ThreadId",
                "value": "9360"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x000017a0"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00001768"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 163
          },
          {
            "timestamp": "2026-05-28 22:43:59,198",
            "thread_id": "8344",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\ncrypt"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95d10000"
              }
            ],
            "repeated": 0,
            "id": 164
          },
          {
            "timestamp": "2026-05-28 22:43:59,198",
            "thread_id": "8344",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\NTASN1"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95cd0000"
              }
            ],
            "repeated": 0,
            "id": 165
          },
          {
            "timestamp": "2026-05-28 22:43:59,198",
            "thread_id": "8344",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\PCPKsp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8e580000"
              }
            ],
            "repeated": 0,
            "id": 166
          },
          {
            "timestamp": "2026-05-28 22:43:59,198",
            "thread_id": "8344",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\imagehlp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff98560000"
              }
            ],
            "repeated": 0,
            "id": 167
          },
          {
            "timestamp": "2026-05-28 22:43:59,198",
            "thread_id": "8344",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\tbs"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8e460000"
              }
            ],
            "repeated": 0,
            "id": 168
          },
          {
            "timestamp": "2026-05-28 22:43:59,213",
            "thread_id": "8344",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\ncryptprov"
              },
              {
                "name": "DllBase",
                "value": "0x7fff834f0000"
              }
            ],
            "repeated": 0,
            "id": 169
          }
        ],
        "threads": [
          "5976",
          "7108",
          "8324",
          "8372",
          "8320",
          "8680",
          "2560",
          "2596",
          "7880",
          "8364",
          "8512",
          "8924",
          "8312",
          "8328",
          "3236",
          "2404",
          "2544",
          "8352",
          "2540",
          "5576",
          "8344",
          "3984"
        ],
        "environ": {
          "UserName": "admin",
          "ComputerName": "JOHNS-PC",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\",
          "CommandLine": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" \"https://sugarcraft.net/\"",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "12bc-0026",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff6f9430000",
          "MainExeSize": "0x00505000",
          "Bitness": "64-bit"
        },
        "file_activities": {
          "read_files": [],
          "write_files": [],
          "delete_files": []
        }
      },
      {
        "process_id": 9356,
        "process_name": "identity_helper.exe",
        "parent_id": 6712,
        "module_path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe",
        "first_seen": "2026-05-28 22:43:59,082",
        "calls": [],
        "threads": [],
        "environ": {
          "UserName": "admin",
          "ComputerName": "JOHNS-PC",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\",
          "CommandLine": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5452,i,6144736785640467952,18088932084502277173,524288 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5700 /prefetch:8",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "12bc-0026",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff61efc0000",
          "MainExeSize": "0x0028c000",
          "Bitness": "64-bit"
        },
        "file_activities": {
          "read_files": [],
          "write_files": [],
          "delete_files": []
        }
      }
    ],
    "anomaly": [],
    "processtree": [
      {
        "name": "explorer.exe",
        "pid": 4676,
        "parent_id": 4608,
        "module_path": "C:\\Windows\\explorer.exe",
        "children": [
          {
            "name": "msedge.exe",
            "pid": 6712,
            "parent_id": 4676,
            "module_path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
            "children": [],
            "threads": [
              "5976",
              "7108",
              "8324",
              "8372",
              "8320",
              "8680",
              "2560",
              "2596",
              "7880",
              "8364",
              "8512",
              "8924",
              "8312",
              "8328",
              "3236",
              "2404",
              "2544",
              "8352",
              "2540",
              "5576",
              "8344",
              "3984"
            ],
            "environ": {
              "UserName": "admin",
              "ComputerName": "JOHNS-PC",
              "WindowsPath": "C:\\Windows",
              "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\",
              "CommandLine": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" \"https://sugarcraft.net/\"",
              "RegisteredOwner": "",
              "RegisteredOrganization": "",
              "ProductName": "",
              "SystemVolumeSerialNumber": "12bc-0026",
              "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
              "MachineGUID": "",
              "MainExeBase": "0x7ff6f9430000",
              "MainExeSize": "0x00505000",
              "Bitness": "64-bit"
            }
          }
        ],
        "threads": [
          "6208",
          "5300",
          "5468"
        ],
        "environ": {
          "UserName": "admin",
          "ComputerName": "JOHNS-PC",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\",
          "CommandLine": "C:\\Windows\\Explorer.EXE",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "12bc-0026",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff663980000",
          "MainExeSize": "0x00546000",
          "Bitness": "64-bit"
        }
      }
    ],
    "summary": {
      "files": [
        "\\Device\\Bam"
      ],
      "read_files": [],
      "write_files": [],
      "delete_files": [],
      "keys": [],
      "read_keys": [],
      "write_keys": [],
      "delete_keys": [],
      "executed_commands": [
        "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=crashpad-handler \"--user-data-dir=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=148.0.7778.180 \"--annotation=exe=C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=148.0.3967.83 --initial-client-data=0x348,0x34c,0x350,0x344,0x358,0x7fff52985d58,0x7fff52985d64,0x7fff52985d70",
        "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=2448,i,8680256655390085944,14781426459881126139,524288 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2560 /prefetch:3",
        "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2180,i,153934363376628892,4001203935498138754,262144 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2356 /prefetch:2",
        "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2752,i,15663351803793895304,5259456288936133186,524288 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2732 /prefetch:8",
        "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780008161768189 --launch-time-ticks=68919650 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3564,i,4594470550112387863,14821651032443296262,2097152 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3560 /prefetch:1",
        "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780008161768189 --launch-time-ticks=68921711 --skip-read-main-dll --metrics-shmem-handle=3664,i,17389617875997663512,49637702052645388,2097152 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3772 /prefetch:1",
        "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --skip-read-main-dll --metrics-shmem-handle=5084,i,16886526138924156661,5957802428661537419,524288 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3092 /prefetch:8",
        "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=5292,i,1418984789271993110,9507067469212756464,524288 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5324 /prefetch:8",
        "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5452,i,6144736785640467952,18088932084502277173,524288 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5700 /prefetch:8"
      ],
      "resolved_apis": [],
      "mutexes": [],
      "created_services": [],
      "started_services": []
    },
    "enhanced": [
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:43:50,479",
        "eid": 1,
        "data": {
          "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=crashpad-handler \"--user-data-dir=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=148.0.7778.180 \"--annotation=exe=C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=148.0.3967.83 --initial-client-data=0x348,0x34c,0x350,0x344,0x358,0x7fff52985d58,0x7fff52985d64,0x7fff52985d70"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:43:50,573",
        "eid": 2,
        "data": {
          "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=2448,i,8680256655390085944,14781426459881126139,524288 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2560 /prefetch:3"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:43:50,588",
        "eid": 3,
        "data": {
          "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2180,i,153934363376628892,4001203935498138754,262144 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2356 /prefetch:2"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:43:50,604",
        "eid": 4,
        "data": {
          "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2752,i,15663351803793895304,5259456288936133186,524288 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2732 /prefetch:8"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:43:50,682",
        "eid": 5,
        "data": {
          "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780008161768189 --launch-time-ticks=68919650 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3564,i,4594470550112387863,14821651032443296262,2097152 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3560 /prefetch:1"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:43:50,682",
        "eid": 6,
        "data": {
          "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780008161768189 --launch-time-ticks=68921711 --skip-read-main-dll --metrics-shmem-handle=3664,i,17389617875997663512,49637702052645388,2097152 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3772 /prefetch:1"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:43:54,260",
        "eid": 7,
        "data": {
          "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --skip-read-main-dll --metrics-shmem-handle=5084,i,16886526138924156661,5957802428661537419,524288 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3092 /prefetch:8"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:43:55,323",
        "eid": 8,
        "data": {
          "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=5292,i,1418984789271993110,9507067469212756464,524288 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5324 /prefetch:8"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:43:59,057",
        "eid": 9,
        "data": {
          "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5452,i,6144736785640467952,18088932084502277173,524288 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,7561877612099264196,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5700 /prefetch:8"
        }
      }
    ],
    "encryptedbuffers": [],
    "network_map": {
      "endpoint_map": {},
      "http_host_map": {},
      "dns_intents": {},
      "http_requests": [],
      "winhttp_sessions": [],
      "com_activations": []
    }
  },
  "debug": {
    "log": "2026-05-28 18:30:47,582 [root] INFO: Date set to: 20260528T18:43:38, timeout set to: 200\n2026-05-28 18:43:38,010 [root] DEBUG: Starting analyzer from: C:\\2unxg6vp\n2026-05-28 18:43:38,011 [root] DEBUG: Storing results at: C:\\uJcYLDyRT\n2026-05-28 18:43:38,011 [root] DEBUG: Pipe server name: \\\\.\\PIPE\\ueorrrZss\n2026-05-28 18:43:38,012 [root] DEBUG: Python path: C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64\n2026-05-28 18:43:38,017 [root] INFO: analysis running as an admin\n2026-05-28 18:43:38,017 [root] INFO: analysis package specified: \"edge\"\n2026-05-28 18:43:38,017 [root] DEBUG: importing analysis package module: \"modules.packages.edge\"...\n2026-05-28 18:43:38,019 [root] DEBUG: imported analysis package \"edge\"\n2026-05-28 18:43:38,020 [root] DEBUG: initializing analysis package \"edge\"...\n2026-05-28 18:43:38,021 [root] DEBUG: New location of moved file: https://sugarcraft.net/\n2026-05-28 18:43:38,021 [root] INFO: Analyzer: Package modules.packages.edge does not specify a dll option\n2026-05-28 18:43:38,022 [root] INFO: Analyzer: Package modules.packages.edge does not specify a dll_64 option\n2026-05-28 18:43:38,022 [root] INFO: Analyzer: Package modules.packages.edge does not specify a loader option\n2026-05-28 18:43:38,022 [root] INFO: Analyzer: Package modules.packages.edge does not specify a loader_64 option\n2026-05-28 18:43:38,042 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.browser\"\n2026-05-28 18:43:38,107 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.digisig\"\n2026-05-28 18:43:38,131 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.disguise\"\n2026-05-28 18:43:38,137 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.human\"\n2026-05-28 18:43:38,140 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'\n2026-05-28 18:43:38,140 [lib.api.screenshot] ERROR: No module named 'PIL'\n2026-05-28 18:43:38,141 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.screenshots\"\n2026-05-28 18:43:38,142 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.tlsdump\"\n2026-05-28 18:43:38,142 [root] DEBUG: Initialized auxiliary module \"Browser\"\n2026-05-28 18:43:38,142 [root] DEBUG: attempting to configure 'Browser' from data\n2026-05-28 18:43:38,143 [root] DEBUG: module Browser does not support data configuration, ignoring\n2026-05-28 18:43:38,143 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.browser\"...\n2026-05-28 18:43:38,143 [root] DEBUG: Started auxiliary module modules.auxiliary.browser\n2026-05-28 18:43:38,143 [root] DEBUG: Initialized auxiliary module \"DigiSig\"\n2026-05-28 18:43:38,145 [root] DEBUG: attempting to configure 'DigiSig' from data\n2026-05-28 18:43:38,146 [root] DEBUG: module DigiSig does not support data configuration, ignoring\n2026-05-28 18:43:38,146 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.digisig\"...\n2026-05-28 18:43:38,147 [modules.auxiliary.digisig] DEBUG: Skipping authenticode validation, analysis is not a file\n2026-05-28 18:43:38,147 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig\n2026-05-28 18:43:38,148 [root] DEBUG: Initialized auxiliary module \"Disguise\"\n2026-05-28 18:43:38,148 [root] DEBUG: attempting to configure 'Disguise' from data\n2026-05-28 18:43:38,148 [root] DEBUG: module Disguise does not support data configuration, ignoring\n2026-05-28 18:43:38,148 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.disguise\"...\n2026-05-28 18:43:38,151 [modules.auxiliary.disguise] INFO: Launched background process notepad.exe hidden (PID: 9032)\n2026-05-28 18:43:38,152 [modules.auxiliary.disguise] INFO: Disguising GUID to 20a4cdc9-c6ba-4179-8ff7-a3938a3b568d\n2026-05-28 18:43:38,152 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise\n2026-05-28 18:43:38,152 [root] DEBUG: Initialized auxiliary module \"Human\"\n2026-05-28 18:43:38,153 [root] DEBUG: attempting to configure 'Human' from data\n2026-05-28 18:43:38,153 [root] DEBUG: module Human does not support data configuration, ignoring\n2026-05-28 18:43:38,153 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.human\"...\n2026-05-28 18:43:38,154 [root] DEBUG: Started auxiliary module modules.auxiliary.human\n2026-05-28 18:43:38,154 [root] DEBUG: Initialized auxiliary module \"Screenshots\"\n2026-05-28 18:43:38,155 [root] DEBUG: attempting to configure 'Screenshots' from data\n2026-05-28 18:43:38,155 [root] DEBUG: module Screenshots does not support data configuration, ignoring\n2026-05-28 18:43:38,155 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.screenshots\"...\n2026-05-28 18:43:38,155 [modules.auxiliary.screenshots] WARNING: Python Image Library is not installed, screenshots are disabled\n2026-05-28 18:43:38,155 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots\n2026-05-28 18:43:38,156 [root] DEBUG: Initialized auxiliary module \"TLSDumpMasterSecrets\"\n2026-05-28 18:43:38,156 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data\n2026-05-28 18:43:38,156 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring\n2026-05-28 18:43:38,156 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.tlsdump\"...\n2026-05-28 18:43:38,158 [modules.auxiliary.tlsdump] WARNING: Unable to find lsass.exe process\n2026-05-28 18:43:38,158 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump\n2026-05-28 18:43:38,158 [root] INFO: Interactive mode enabled - injecting into explorer shell\n2026-05-28 18:43:38,220 [lib.api.process] INFO: Monitor config for process 4676: C:\\2unxg6vp\\dll\\4676.ini\n2026-05-28 18:43:38,221 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 18:43:38,223 [lib.api.process] INFO: 64-bit DLL to inject is C:\\2unxg6vp\\dll\\lvMMtOS.dll, loader C:\\2unxg6vp\\bin\\KIsHRknn.exe\n2026-05-28 18:43:38,263 [root] DEBUG: Loader: Injecting process 4676 with C:\\2unxg6vp\\dll\\lvMMtOS.dll.\n2026-05-28 18:43:38,444 [root] DEBUG: 4676: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-28 18:43:38,448 [root] DEBUG: 4676: Disabling sleep skipping.\n2026-05-28 18:43:38,451 [root] DEBUG: 4676: Interactive desktop enabled.\n2026-05-28 18:43:38,453 [root] DEBUG: 4676: Dropped file limit defaulting to 100.\n2026-05-28 18:43:38,457 [root] DEBUG: 4676: Interactive desktop - injecting Explorer Shell\n2026-05-28 18:43:38,471 [root] DEBUG: 4676: YaraInit: Compiled 44 rule files\n2026-05-28 18:43:38,472 [root] DEBUG: 4676: YaraInit: Compiled rules saved to file C:\\2unxg6vp\\data\\yara\\capemon.yac\n2026-05-28 18:43:38,500 [root] DEBUG: 4676: RtlInsertInvertedFunctionTable 0x00007FFF98C6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF98DBD4F0\n2026-05-28 18:43:38,500 [root] DEBUG: 4676: YaraScan: Scanning 0x00007FF663980000, size 0x545316\n2026-05-28 18:43:38,571 [root] DEBUG: 4676: Monitor initialised: 64-bit capemon loaded in process 4676 at 0x00007FFF52E70000, thread 908, image base 0x00007FF663980000, stack from 0x0000000010E52000-0x0000000010E60000\n2026-05-28 18:43:38,572 [root] DEBUG: 4676: Commandline: C:\\Windows\\Explorer.EXE\n2026-05-28 18:43:38,584 [root] DEBUG: 4676: Hooked 69 out of 69 functions\n2026-05-28 18:43:38,621 [root] DEBUG: 4676: Syscall hook installed, syscall logging level 1\n2026-05-28 18:43:38,627 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.\n2026-05-28 18:43:38,628 [root] DEBUG: Successfully injected DLL C:\\2unxg6vp\\dll\\lvMMtOS.dll.\n2026-05-28 18:43:38,630 [lib.api.process] INFO: Injected into 64-bit <Process 4676 explorer.exe>\n2026-05-28 18:43:45,926 [root] INFO: Restarting WMI Service\n2026-05-28 18:43:48,024 [root] DEBUG: package modules.packages.edge does not support configure, ignoring\n2026-05-28 18:43:48,026 [root] WARNING: configuration error for package modules.packages.edge: error importing data.packages.edge: No module named 'data.packages'\n2026-05-28 18:43:48,028 [lib.core.compound] INFO: C:\\Users\\admin\\AppData\\Local\\Temp already exists, skipping creation\n2026-05-28 18:43:48,033 [lib.api.process] INFO: Successfully executed process from path \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" with arguments \"\"https://sugarcraft.net/\"\" with pid 6712\n2026-05-28 18:43:48,034 [lib.api.process] INFO: Monitor config for process 6712: C:\\2unxg6vp\\dll\\6712.ini\n2026-05-28 18:43:48,037 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 18:43:48,040 [lib.api.process] INFO: 64-bit DLL to inject is C:\\2unxg6vp\\dll\\lvMMtOS.dll, loader C:\\2unxg6vp\\bin\\KIsHRknn.exe\n2026-05-28 18:43:48,049 [root] DEBUG: Loader: Injecting process 6712 (thread 5976) with C:\\2unxg6vp\\dll\\lvMMtOS.dll.\n2026-05-28 18:43:48,049 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 18:43:48,050 [root] DEBUG: Successfully injected DLL C:\\2unxg6vp\\dll\\lvMMtOS.dll.\n2026-05-28 18:43:48,051 [lib.api.process] INFO: Injected into 64-bit <Process 6712 msedge.exe>\n2026-05-28 18:43:50,058 [lib.api.process] INFO: Successfully resumed process with pid 6712\n2026-05-28 18:43:50,191 [root] DEBUG: 6712: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-28 18:43:50,192 [root] DEBUG: 6712: Disabling sleep skipping.\n2026-05-28 18:43:50,193 [root] DEBUG: 6712: Interactive desktop enabled.\n2026-05-28 18:43:50,194 [root] DEBUG: 6712: Dropped file limit defaulting to 100.\n2026-05-28 18:43:50,234 [root] DEBUG: 6712: Edge-specific hook-set enabled.\n2026-05-28 18:43:50,244 [root] DEBUG: 6712: YaraInit: Compiled rules loaded from existing file C:\\2unxg6vp\\data\\yara\\capemon.yac\n2026-05-28 18:43:50,265 [root] DEBUG: 6712: RtlInsertInvertedFunctionTable 0x00007FFF98C6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF98DBD4F0\n2026-05-28 18:43:50,266 [root] DEBUG: 6712: Monitor initialised: 64-bit capemon loaded in process 6712 at 0x00007FFF52E70000, thread 5976, image base 0x00007FF6F9430000, stack from 0x0000000ED37F4000-0x0000000ED3800000\n2026-05-28 18:43:50,266 [root] DEBUG: 6712: Commandline: \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" \"https://sugarcraft.net/\"\n2026-05-28 18:43:50,278 [root] DEBUG: 6712: Hooked 2 out of 2 functions\n2026-05-28 18:43:50,312 [root] DEBUG: 6712: Syscall hook installed, syscall logging level 1\n2026-05-28 18:43:50,316 [root] DEBUG: 6712: RestoreHeaders: Restored original import table.\n2026-05-28 18:43:50,317 [root] INFO: Loaded monitor into process with pid 6712\n2026-05-28 18:43:50,319 [root] DEBUG: 6712: DLL loaded at 0x00007FFF96C20000: C:\\Windows\\System32\\bcryptprimitives (0x82000 bytes).\n2026-05-28 18:43:50,325 [root] DEBUG: 6712: DLL loaded at 0x00007FFF853A0000: C:\\Windows\\SYSTEM32\\version (0xa000 bytes).\n2026-05-28 18:43:50,326 [root] DEBUG: 6712: DLL loaded at 0x00007FFF984B0000: C:\\Windows\\System32\\shcore (0xad000 bytes).\n2026-05-28 18:43:50,327 [root] DEBUG: 6712: DLL loaded at 0x00007FFF95CA0000: C:\\Windows\\SYSTEM32\\Wldp (0x2d000 bytes).\n2026-05-28 18:43:50,327 [root] DEBUG: 6712: DLL loaded at 0x00007FFF94410000: C:\\Windows\\SYSTEM32\\windows.storage (0x79b000 bytes).\n2026-05-28 18:43:50,328 [root] DEBUG: 6712: DLL loaded at 0x00007FFF984B0000: C:\\Windows\\System32\\SHCORE (0xad000 bytes).\n2026-05-28 18:43:50,329 [root] DEBUG: 6712: DLL loaded at 0x00007FFF95450000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-28 18:43:50,478 [root] DEBUG: 6712: DLL loaded at 0x00007FFF84A60000: C:\\Windows\\SYSTEM32\\WINMM (0x27000 bytes).\n2026-05-28 18:43:50,479 [root] DEBUG: 6712: DLL loaded at 0x00007FFF3EE40000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge (0x136be000 bytes).\n2026-05-28 18:43:50,482 [root] DEBUG: 6712: DLL loaded at 0x00007FFF833E0000: C:\\Windows\\SYSTEM32\\KBDUS (0x9000 bytes).\n2026-05-28 18:43:50,484 [root] DEBUG: 6712: DLL loaded at 0x00007FFF93CF0000: C:\\Windows\\system32\\uxtheme (0x9e000 bytes).\n2026-05-28 18:43:50,488 [root] DEBUG: 6712: DLL loaded at 0x00007FFF94210000: C:\\Windows\\SYSTEM32\\kernel.appcore (0x12000 bytes).\n2026-05-28 18:43:50,489 [root] DEBUG: 6712: CreateProcessHandler: Injection info set for new process 7104: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF6F9430000\n2026-05-28 18:43:50,489 [root] DEBUG: 6712: ProcessMessage: Skipping monitoring process 7104\n2026-05-28 18:43:50,490 [root] DEBUG: 6712: DLL loaded at 0x00007FFF98230000: C:\\Windows\\System32\\clbcatq (0xa9000 bytes).\n2026-05-28 18:43:50,490 [root] DEBUG: 6712: ProcessMessage: Skipping monitoring process 7104\n2026-05-28 18:43:50,491 [root] DEBUG: 6712: DLL loaded at 0x00007FFF92010000: C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings (0x16000 bytes).\n2026-05-28 18:43:50,492 [root] DEBUG: 6712: DLL loaded at 0x00007FFF953C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-28 18:43:50,493 [root] DEBUG: 6712: DLL loaded at 0x00007FFF90020000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-28 18:43:50,496 [root] DEBUG: 6712: DLL loaded at 0x00007FFF96220000: C:\\Windows\\SYSTEM32\\USERENV (0x2e000 bytes).\n2026-05-28 18:43:50,497 [root] DEBUG: 6712: DLL loaded at 0x00007FFF94BC0000: C:\\Windows\\SYSTEM32\\gpapi (0x23000 bytes).\n2026-05-28 18:43:50,498 [root] DEBUG: 6712: DLL loaded at 0x00007FFF95490000: C:\\Windows\\SYSTEM32\\wkscli (0x19000 bytes).\n2026-05-28 18:43:50,499 [root] DEBUG: 6712: DLL loaded at 0x00007FFF95850000: C:\\Windows\\SYSTEM32\\netutils (0xc000 bytes).\n2026-05-28 18:43:50,500 [root] DEBUG: 6712: DLL loaded at 0x00007FFF953C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-28 18:43:50,500 [root] DEBUG: 6712: DLL loaded at 0x00007FFF8C000000: C:\\Windows\\SYSTEM32\\MDMRegistration (0x68000 bytes).\n2026-05-28 18:43:50,502 [root] DEBUG: 6712: DLL loaded at 0x00007FFF96190000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-28 18:43:50,502 [root] DEBUG: 6712: DLL loaded at 0x00007FFF95BF0000: C:\\Windows\\SYSTEM32\\CRYPTSP (0x18000 bytes).\n2026-05-28 18:43:50,503 [root] DEBUG: 6712: DLL loaded at 0x00007FFF95D10000: C:\\Windows\\SYSTEM32\\ncrypt (0x27000 bytes).\n2026-05-28 18:43:50,503 [root] DEBUG: 6712: DLL loaded at 0x00007FFF98560000: C:\\Windows\\System32\\imagehlp (0x1d000 bytes).\n2026-05-28 18:43:50,503 [root] DEBUG: 6712: DLL loaded at 0x00007FFF8E460000: C:\\Windows\\SYSTEM32\\tbs (0x1b000 bytes).\n2026-05-28 18:43:50,504 [root] DEBUG: 6712: DLL loaded at 0x00007FFF82660000: C:\\Windows\\SYSTEM32\\DMCmnUtils (0x7c000 bytes).\n2026-05-28 18:43:50,504 [root] DEBUG: 6712: DLL loaded at 0x00007FFF8BFC0000: C:\\Windows\\SYSTEM32\\omadmapi (0x3a000 bytes).\n2026-05-28 18:43:50,505 [root] DEBUG: 6712: DLL loaded at 0x00007FFF96170000: C:\\Windows\\SYSTEM32\\UMPDC (0x12000 bytes).\n2026-05-28 18:43:50,506 [root] DEBUG: 6712: DLL loaded at 0x00007FFF95CD0000: C:\\Windows\\SYSTEM32\\NTASN1 (0x3b000 bytes).\n2026-05-28 18:43:50,507 [root] DEBUG: 6712: DLL loaded at 0x00007FFF85400000: C:\\Windows\\SYSTEM32\\netapi32 (0x19000 bytes).\n2026-05-28 18:43:50,508 [root] DEBUG: 6712: DLL loaded at 0x00007FFF953C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-28 18:43:50,509 [root] DEBUG: 6712: DLL loaded at 0x00007FFF95BF0000: C:\\Windows\\SYSTEM32\\cryptsp (0x18000 bytes).\n2026-05-28 18:43:50,509 [root] DEBUG: 6712: DLL loaded at 0x00007FFF92030000: C:\\Windows\\SYSTEM32\\DSREG (0x141000 bytes).\n2026-05-28 18:43:50,510 [root] DEBUG: 6712: DLL loaded at 0x00007FFF96260000: C:\\Windows\\SYSTEM32\\profapi (0x25000 bytes).\n2026-05-28 18:43:50,518 [root] DEBUG: 6712: DLL loaded at 0x00007FFF8C050000: C:\\Windows\\System32\\AssignedAccessRuntime (0x14000 bytes).\n2026-05-28 18:43:50,519 [root] DEBUG: 6712: DLL loaded at 0x00007FFF97F00000: C:\\Windows\\System32\\MSCTF (0x114000 bytes).\n2026-05-28 18:43:50,520 [root] DEBUG: 6712: DLL loaded at 0x00007FFF8CEF0000: C:\\Windows\\System32\\SystemSettings.DataModel (0x74000 bytes).\n2026-05-28 18:43:50,520 [root] DEBUG: 6712: DLL loaded at 0x00007FFF96190000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-28 18:43:50,521 [root] DEBUG: 6712: DLL loaded at 0x00007FFF96170000: C:\\Windows\\SYSTEM32\\UMPDC (0x12000 bytes).\n2026-05-28 18:43:50,522 [root] DEBUG: 6712: DLL loaded at 0x00007FFF8A140000: C:\\Windows\\SYSTEM32\\DWrite (0x27f000 bytes).\n2026-05-28 18:43:50,525 [root] DEBUG: 6712: DLL loaded at 0x00007FFF82ED0000: C:\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\\COMCTL32 (0x29a000 bytes).\n2026-05-28 18:43:50,525 [root] DEBUG: 6712: DLL loaded at 0x00007FFF8F850000: C:\\Windows\\System32\\OneCoreUAPCommonProxyStub (0x7d0000 bytes).\n2026-05-28 18:43:50,526 [root] DEBUG: 6712: DLL loaded at 0x00007FFF960B0000: C:\\Windows\\SYSTEM32\\DPAPI (0xa000 bytes).\n2026-05-28 18:43:50,528 [root] DEBUG: 6712: DLL loaded at 0x00007FFF956F0000: C:\\Windows\\SYSTEM32\\IPHLPAPI (0x3b000 bytes).\n2026-05-28 18:43:50,528 [root] DEBUG: 6712: DLL loaded at 0x00007FFF91940000: C:\\Windows\\system32\\NLAapi (0x1d000 bytes).\n2026-05-28 18:43:50,530 [root] DEBUG: 6712: DLL loaded at 0x00007FFF98020000: C:\\Windows\\System32\\NSI (0x8000 bytes).\n2026-05-28 18:43:50,530 [root] DEBUG: 6712: DLL loaded at 0x00007FFF96AF0000: C:\\Windows\\System32\\CFGMGR32 (0x4e000 bytes).\n2026-05-28 18:43:50,531 [root] DEBUG: 6712: DLL loaded at 0x00007FFF8EAD0000: C:\\Windows\\SYSTEM32\\dhcpcsvc6 (0x17000 bytes).\n2026-05-28 18:43:50,531 [root] DEBUG: 6712: DLL loaded at 0x00007FFF8BEB0000: C:\\Windows\\System32\\StructuredQuery (0xa6000 bytes).\n2026-05-28 18:43:50,532 [root] DEBUG: 6712: DLL loaded at 0x00007FFF8EAB0000: C:\\Windows\\SYSTEM32\\dhcpcsvc (0x1d000 bytes).\n2026-05-28 18:43:50,533 [root] DEBUG: 6712: DLL loaded at 0x00007FFF95730000: C:\\Windows\\SYSTEM32\\DNSAPI (0xca000 bytes).\n2026-05-28 18:43:50,534 [root] DEBUG: 6712: DLL loaded at 0x00007FFF91EB0000: C:\\Windows\\SYSTEM32\\PROPSYS (0xf6000 bytes).\n2026-05-28 18:43:50,536 [root] DEBUG: 6712: DLL loaded at 0x00007FFF8B820000: C:\\Windows\\System32\\Windows.StateRepositoryPS (0x146000 bytes).\n2026-05-28 18:43:50,538 [root] DEBUG: 6712: DLL loaded at 0x00007FFF93840000: C:\\Windows\\System32\\CoreMessaging (0xf2000 bytes).\n2026-05-28 18:43:50,538 [root] DEBUG: 6712: DLL loaded at 0x00007FFF92180000: C:\\Windows\\SYSTEM32\\wintypes (0x155000 bytes).\n2026-05-28 18:43:50,539 [root] DEBUG: 6712: DLL loaded at 0x00007FFF93160000: C:\\Windows\\System32\\CoreUIComponents (0x35b000 bytes).\n2026-05-28 18:43:50,539 [root] DEBUG: 6712: DLL loaded at 0x00007FFF8A6E0000: C:\\Windows\\SYSTEM32\\textinputframework (0xf9000 bytes).\n2026-05-28 18:43:50,541 [root] DEBUG: 6712: DLL loaded at 0x00007FFF8B750000: C:\\Windows\\system32\\Windows.Storage.Search (0xc6000 bytes).\n2026-05-28 18:43:50,543 [root] DEBUG: 6712: DLL loaded at 0x00007FFF90DA0000: C:\\Windows\\System32\\twinapi.appcore (0x203000 bytes).\n2026-05-28 18:43:50,545 [root] DEBUG: 6712: DLL loaded at 0x00007FFF82BC0000: C:\\Windows\\system32\\twinapi (0xa9000 bytes).\n2026-05-28 18:43:50,546 [root] DEBUG: 6712: DLL loaded at 0x00007FFF8A550000: C:\\Windows\\system32\\mssprxy (0x28000 bytes).\n2026-05-28 18:43:50,549 [root] DEBUG: 6712: DLL loaded at 0x00007FFF905B0000: C:\\Windows\\SYSTEM32\\wevtapi (0x65000 bytes).\n2026-05-28 18:43:50,551 [root] DEBUG: 6712: DLL loaded at 0x00007FFF86740000: C:\\Windows\\SYSTEM32\\edputil (0x24000 bytes).\n2026-05-28 18:43:50,553 [root] DEBUG: 6712: DLL loaded at 0x00007FFF90FB0000: C:\\Windows\\System32\\WindowManagementAPI (0xa1000 bytes).\n2026-05-28 18:43:50,554 [root] DEBUG: 6712: DLL loaded at 0x00007FFF8A580000: C:\\Windows\\System32\\InputHost (0x152000 bytes).\n2026-05-28 18:43:50,554 [root] DEBUG: 6712: DLL loaded at 0x00007FFF8A7E0000: C:\\Windows\\System32\\Windows.UI (0x141000 bytes).\n2026-05-28 18:43:50,556 [root] DEBUG: 6712: DLL loaded at 0x00007FFF91FE0000: C:\\Windows\\SYSTEM32\\WTSAPI32 (0x14000 bytes).\n2026-05-28 18:43:50,557 [root] DEBUG: 6712: DLL loaded at 0x00007FFF8C3B0000: C:\\Windows\\System32\\iertutil (0x2bc000 bytes).\n2026-05-28 18:43:50,559 [root] DEBUG: 6712: DLL loaded at 0x00007FFF865D0000: C:\\Windows\\System32\\Windows.Web (0xc3000 bytes).\n2026-05-28 18:43:50,560 [root] DEBUG: 6712: DLL loaded at 0x00007FFF95FF0000: C:\\Windows\\SYSTEM32\\WINSTA (0x5b000 bytes).\n2026-05-28 18:43:50,562 [root] DEBUG: 6712: DLL loaded at 0x00007FFF90620000: C:\\Windows\\SYSTEM32\\ColorAdapterClient (0x11000 bytes).\n2026-05-28 18:43:50,563 [root] DEBUG: 6712: DLL loaded at 0x00007FFF90660000: C:\\Windows\\SYSTEM32\\mscms (0xae000 bytes).\n2026-05-28 18:43:50,570 [root] DEBUG: 6712: DLL loaded at 0x00007FFF90780000: C:\\Windows\\SYSTEM32\\WINHTTP (0x10a000 bytes).\n2026-05-28 18:43:50,575 [root] DEBUG: 6712: DLL loaded at 0x00007FFF3D4E0000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\oneauth (0x5c4000 bytes).\n2026-05-28 18:43:50,584 [root] DEBUG: 6712: CreateProcessHandler: Injection info set for new process 1392: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF6F9430000\n2026-05-28 18:43:50,584 [root] DEBUG: 6712: ProcessMessage: Skipping monitoring process 1392\n2026-05-28 18:43:50,586 [root] DEBUG: 6712: ProcessMessage: Skipping monitoring process 1392\n2026-05-28 18:43:50,587 [root] DEBUG: 6712: DLL loaded at 0x00007FFF8A3C0000: C:\\Windows\\System32\\Windows.UI.Immersive (0x139000 bytes).\n2026-05-28 18:43:50,588 [root] DEBUG: 6712: DLL loaded at 0x00007FFF87320000: C:\\Windows\\SYSTEM32\\Secur32 (0xc000 bytes).\n2026-05-28 18:43:50,591 [root] DEBUG: 6712: caller_dispatch: Added region at 0x00007FF6F9430000 to tracked regions list (kernel32::CreateProcessInternalW returns to 0x00007FF6F9527D66, thread 8324).\n2026-05-28 18:43:50,596 [root] DEBUG: 6712: ProcessImageBase: Main module image at 0x00007FF6F9430000 unmodified (entropy change 0.000000e+00)\n2026-05-28 18:43:50,597 [root] DEBUG: 6712: CreateProcessHandler: Injection info set for new process 9044: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF6F9430000\n2026-05-28 18:43:50,598 [root] DEBUG: 6712: ProcessMessage: Skipping monitoring process 9044\n2026-05-28 18:43:50,598 [root] DEBUG: 6712: ProcessMessage: Skipping monitoring process 9044\n2026-05-28 18:43:50,603 [root] DEBUG: 6712: CreateProcessHandler: Injection info set for new process 8452: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF6F9430000\n2026-05-28 18:43:50,608 [root] DEBUG: 6712: DLL loaded at 0x00007FFF960C0000: C:\\Windows\\SYSTEM32\\sxs (0xa2000 bytes).\n2026-05-28 18:43:50,611 [root] DEBUG: 6712: ProcessMessage: Skipping monitoring process 8452\n2026-05-28 18:43:50,612 [root] DEBUG: 6712: DLL loaded at 0x00007FFF853F0000: C:\\Windows\\SYSTEM32\\LINKINFO (0xd000 bytes).\n2026-05-28 18:43:50,615 [root] DEBUG: 6712: ProcessMessage: Skipping monitoring process 8452\n2026-05-28 18:43:50,616 [root] DEBUG: 6712: DLL loaded at 0x00007FFF916B0000: C:\\Windows\\SYSTEM32\\usermgrcli (0x16000 bytes).\n2026-05-28 18:43:50,616 [root] DEBUG: 6712: DLL loaded at 0x00007FFF7DDC0000: C:\\Windows\\System32\\Windows.Internal.UI.Shell.WindowTabManager (0x6d000 bytes).\n2026-05-28 18:43:50,647 [root] DEBUG: 6712: DLL loaded at 0x00007FFF94BF0000: C:\\Windows\\system32\\dxgi (0xf3000 bytes).\n2026-05-28 18:43:50,648 [root] DEBUG: 6712: DLL loaded at 0x00007FFF92740000: C:\\Windows\\system32\\d3d11 (0x263000 bytes).\n2026-05-28 18:43:50,649 [root] DEBUG: 6712: DLL loaded at 0x00007FFF929B0000: C:\\Windows\\system32\\dcomp (0x1e3000 bytes).\n2026-05-28 18:43:50,649 [root] DEBUG: 6712: DLL loaded at 0x00007FFF80590000: C:\\Windows\\system32\\dataexchange (0x3e000 bytes).\n2026-05-28 18:43:50,671 [root] DEBUG: 6712: DLL loaded at 0x00007FFF8BF90000: C:\\Windows\\System32\\Windows.System.Profile.RetailInfo (0x28000 bytes).\n2026-05-28 18:43:50,684 [root] DEBUG: 6712: DLL loaded at 0x00007FFF93E40000: C:\\Windows\\SYSTEM32\\dwmapi (0x2f000 bytes).\n2026-05-28 18:43:50,690 [root] DEBUG: 6712: DLL loaded at 0x00007FFF80840000: C:\\Windows\\SYSTEM32\\OLEACC (0x66000 bytes).\n2026-05-28 18:43:50,691 [root] DEBUG: 6712: CreateProcessHandler: Injection info set for new process 2976: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF6F9430000\n2026-05-28 18:43:50,691 [root] DEBUG: 6712: ProcessMessage: Skipping monitoring process 2976\n2026-05-28 18:43:50,691 [root] DEBUG: 6712: CreateProcessHandler: Injection info set for new process 4752: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF6F9430000\n2026-05-28 18:43:50,692 [root] DEBUG: 6712: ProcessMessage: Skipping monitoring process 2976\n2026-05-28 18:43:50,692 [root] DEBUG: 6712: ProcessMessage: Skipping monitoring process 4752\n2026-05-28 18:43:50,692 [root] DEBUG: 6712: DLL loaded at 0x00007FFF877F0000: C:\\Windows\\system32\\directmanipulation (0x9d000 bytes).\n2026-05-28 18:43:50,693 [root] DEBUG: 6712: ProcessMessage: Skipping monitoring process 4752\n2026-05-28 18:43:50,728 [root] DEBUG: 4676: YaraScan: Scanning 0x00007FF663980000, size 0x545316\n2026-05-28 18:43:50,732 [root] DEBUG: 4676: caller_dispatch: Added region at 0x00007FF663980000 to tracked regions list (ntdll::NtCreateFile returns to 0x00007FF6639ACA89, thread 4900).\n2026-05-28 18:43:50,733 [root] DEBUG: 4676: YaraScan: Scanning 0x00007FF663980000, size 0x545316\n2026-05-28 18:43:50,784 [root] DEBUG: 4676: ProcessImageBase: Main module image at 0x00007FF663980000 unmodified (entropy change 0.000000e+00)\n2026-05-28 18:43:50,785 [root] DEBUG: 6712: DLL loaded at 0x00007FFF81570000: C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Well Known Domains\\1.2.0.0\\well_known_domains (0x9e000 bytes).\n2026-05-28 18:43:50,785 [root] DEBUG: 4676: ProcessImageBase: Main module image at 0x00007FF663980000 unmodified (entropy change 0.000000e+00)\n2026-05-28 18:43:50,850 [root] DEBUG: 6712: DLL loaded at 0x00007FFF95E30000: C:\\Windows\\SYSTEM32\\MSASN1 (0x12000 bytes).\n2026-05-28 18:43:50,858 [root] DEBUG: 6712: DLL loaded at 0x00007FFF95BF0000: C:\\Windows\\SYSTEM32\\CRYPTSP (0x18000 bytes).\n2026-05-28 18:43:50,859 [root] DEBUG: 6712: DLL loaded at 0x00007FFF84F00000: C:\\Windows\\System32\\Windows.Security.Authentication.Web.Core (0x11d000 bytes).\n2026-05-28 18:43:50,860 [root] DEBUG: 6712: DLL loaded at 0x00007FFF95330000: C:\\Windows\\system32\\rsaenh (0x34000 bytes).\n2026-05-28 18:43:50,880 [root] DEBUG: 6712: DLL loaded at 0x00007FFF874D0000: C:\\Windows\\System32\\OneCoreCommonProxyStub (0x7f000 bytes).\n2026-05-28 18:43:50,882 [root] DEBUG: 6712: DLL loaded at 0x00007FFF78140000: C:\\Windows\\System32\\vaultcli (0x51000 bytes).\n2026-05-28 18:43:50,900 [root] DEBUG: 6712: DLL loaded at 0x00007FFF7FD60000: C:\\Windows\\System32\\aadWamExtension (0x36000 bytes).\n2026-05-28 18:43:50,904 [root] DEBUG: 6712: DLL loaded at 0x00007FFF7FB90000: C:\\Windows\\System32\\MicrosoftAccountWAMExtension (0x8c000 bytes).\n2026-05-28 18:43:52,005 [root] DEBUG: 6712: DLL loaded at 0x00007FFF7CEE0000: C:\\Windows\\System32\\ShellCommonCommonProxyStub (0xe4000 bytes).\n2026-05-28 18:43:52,505 [root] DEBUG: 6712: DLL loaded at 0x00007FFF953C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-28 18:43:52,506 [root] DEBUG: 6712: DLL loaded at 0x00007FFF90020000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-28 18:43:54,255 [root] DEBUG: 6712: CreateProcessHandler: Injection info set for new process 6460: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF6F9430000\n2026-05-28 18:43:54,257 [root] DEBUG: 6712: ProcessMessage: Skipping monitoring process 6460\n2026-05-28 18:43:54,258 [root] DEBUG: 6712: ProcessMessage: Skipping monitoring process 6460\n2026-05-28 18:43:55,318 [root] DEBUG: 6712: DLL loaded at 0x00007FFF986E0000: C:\\Windows\\System32\\SETUPAPI (0x46e000 bytes).\n2026-05-28 18:43:55,320 [root] DEBUG: 6712: CreateProcessHandler: Injection info set for new process 8668: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF6F9430000\n2026-05-28 18:43:55,321 [root] DEBUG: 6712: ProcessMessage: Skipping monitoring process 8668\n2026-05-28 18:43:55,322 [root] DEBUG: 6712: DLL loaded at 0x00007FFF91760000: C:\\Windows\\System32\\netprofm (0x3f000 bytes).\n2026-05-28 18:43:55,323 [root] DEBUG: 6712: ProcessMessage: Skipping monitoring process 8668\n2026-05-28 18:43:55,401 [root] DEBUG: 6712: DLL loaded at 0x00007FFF3A630000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\telclient (0x3ed000 bytes).\n2026-05-28 18:43:55,444 [root] DEBUG: 6712: DLL loaded at 0x00007FFF96050000: C:\\Windows\\SYSTEM32\\DEVOBJ (0x33000 bytes).\n2026-05-28 18:43:55,445 [root] DEBUG: 6712: DLL loaded at 0x00007FFF96A80000: C:\\Windows\\System32\\WINTRUST (0x67000 bytes).\n2026-05-28 18:43:55,446 [root] DEBUG: 6712: DLL loaded at 0x00007FFF8E350000: C:\\Windows\\System32\\npmproxy (0x10000 bytes).\n2026-05-28 18:43:55,449 [root] DEBUG: 6712: DLL loaded at 0x00007FFF39FD0000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\oneds (0x33f000 bytes).\n2026-05-28 18:43:55,456 [root] DEBUG: 6712: DLL loaded at 0x00007FFF3D070000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\ffmpeg (0x467000 bytes).\n2026-05-28 18:43:55,460 [root] DEBUG: 6712: DLL loaded at 0x00007FFF8BF70000: C:\\Windows\\system32\\TenantRestrictionsPlugin (0x1b000 bytes).\n2026-05-28 18:43:55,463 [root] DEBUG: 6712: DLL loaded at 0x00007FFF94F50000: C:\\Windows\\System32\\FirewallAPI (0x96000 bytes).\n2026-05-28 18:43:55,464 [root] DEBUG: 6712: DLL loaded at 0x00007FFF94F10000: C:\\Windows\\System32\\fwbase (0x36000 bytes).\n2026-05-28 18:43:55,466 [root] DEBUG: 6712: CreateProcessHandler: Injection info set for new process 3144: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe, ImageBase: 0x00007FF61EFC0000\n2026-05-28 18:43:55,467 [root] INFO: Announced 64-bit process name: identity_helper.exe pid: 3144\n2026-05-28 18:43:55,468 [lib.api.process] INFO: Monitor config for process 3144: C:\\2unxg6vp\\dll\\3144.ini\n2026-05-28 18:43:55,472 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 18:43:55,484 [root] DEBUG: 6712: DLL loaded at 0x00007FFF7FAB0000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\microsoft_shell_integration (0x78000 bytes).\n2026-05-28 18:43:56,101 [root] DEBUG: 6712: DLL loaded at 0x00007FFF94110000: C:\\Windows\\System32\\RMCLIENT (0x2a000 bytes).\n2026-05-28 18:43:56,102 [root] DEBUG: 6712: DLL loaded at 0x00007FFF91E70000: C:\\Windows\\System32\\XmlLite (0x36000 bytes).\n2026-05-28 18:43:56,103 [root] DEBUG: 6712: DLL loaded at 0x00007FFF82770000: C:\\Windows\\System32\\wpnapps (0x15b000 bytes).\n2026-05-28 18:43:58,815 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll\n2026-05-28 18:43:58,816 [lib.api.process] INFO: Potential dll side-loading detected in local directory: onnxruntime.dll\n2026-05-28 18:43:58,821 [lib.api.process] INFO: 64-bit DLL to inject is C:\\2unxg6vp\\dll\\lvMMtOS.dll, loader C:\\2unxg6vp\\bin\\KIsHRknn.exe\n2026-05-28 18:43:58,827 [root] DEBUG: Loader: Injecting process 3144 (thread 2216) with C:\\2unxg6vp\\dll\\lvMMtOS.dll.\n2026-05-28 18:43:58,828 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 18:43:58,828 [root] DEBUG: Successfully injected DLL C:\\2unxg6vp\\dll\\lvMMtOS.dll.\n2026-05-28 18:43:58,830 [lib.api.process] INFO: Injected into 64-bit <Process 3144 identity_helper.exe>\n2026-05-28 18:43:58,835 [root] DEBUG: 6712: DLL loaded at 0x00007FFF8E6A0000: C:\\Windows\\SYSTEM32\\capauthz (0x51000 bytes).\n2026-05-28 18:43:58,844 [root] DEBUG: 6712: DLL loaded at 0x00007FFF8B370000: C:\\Windows\\SYSTEM32\\windows.staterepositorycore (0x11000 bytes).\n2026-05-28 18:43:58,845 [root] DEBUG: 6712: CreateProcessHandler: Injection info set for new process 9356: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe, ImageBase: 0x00007FF61EFC0000\n2026-05-28 18:43:58,846 [root] INFO: Announced 64-bit process name: identity_helper.exe pid: 9356\n2026-05-28 18:43:58,846 [lib.api.process] INFO: Monitor config for process 9356: C:\\2unxg6vp\\dll\\9356.ini\n2026-05-28 18:43:58,847 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 18:43:58,861 [root] DEBUG: 6712: DLL loaded at 0x00007FFF8E370000: C:\\Windows\\system32\\wlanapi (0x74000 bytes).\n2026-05-28 18:43:58,882 [root] DEBUG: 6712: DLL loaded at 0x00007FFF85060000: C:\\Windows\\System32\\Windows.ApplicationModel (0xe9000 bytes).\n2026-05-28 18:43:58,883 [root] DEBUG: 6712: DLL loaded at 0x00007FFF8ED20000: C:\\Windows\\System32\\AppXDeploymentClient (0x102000 bytes).\n2026-05-28 18:43:58,932 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll\n2026-05-28 18:43:58,932 [lib.api.process] INFO: Potential dll side-loading detected in local directory: onnxruntime.dll\n2026-05-28 18:43:58,934 [lib.api.process] INFO: 64-bit DLL to inject is C:\\2unxg6vp\\dll\\lvMMtOS.dll, loader C:\\2unxg6vp\\bin\\KIsHRknn.exe\n2026-05-28 18:43:58,939 [root] DEBUG: Loader: Injecting process 9356 (thread 9360) with C:\\2unxg6vp\\dll\\lvMMtOS.dll.\n2026-05-28 18:43:58,940 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 18:43:58,940 [root] DEBUG: Successfully injected DLL C:\\2unxg6vp\\dll\\lvMMtOS.dll.\n2026-05-28 18:43:58,942 [lib.api.process] INFO: Injected into 64-bit <Process 9356 identity_helper.exe>\n2026-05-28 18:43:58,944 [root] INFO: Announced 64-bit process name: identity_helper.exe pid: 9356\n2026-05-28 18:43:58,944 [lib.api.process] INFO: Monitor config for process 9356: C:\\2unxg6vp\\dll\\9356.ini\n2026-05-28 18:43:58,958 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 18:43:59,026 [root] DEBUG: 6712: DLL loaded at 0x00007FFF85400000: C:\\Windows\\SYSTEM32\\NETAPI32 (0x19000 bytes).\n2026-05-28 18:43:59,032 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll\n2026-05-28 18:43:59,033 [lib.api.process] INFO: Potential dll side-loading detected in local directory: onnxruntime.dll\n2026-05-28 18:43:59,043 [lib.api.process] INFO: 64-bit DLL to inject is C:\\2unxg6vp\\dll\\lvMMtOS.dll, loader C:\\2unxg6vp\\bin\\KIsHRknn.exe\n2026-05-28 18:43:59,049 [root] DEBUG: Loader: Injecting process 9356 (thread 9360) with C:\\2unxg6vp\\dll\\lvMMtOS.dll.\n2026-05-28 18:43:59,050 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 18:43:59,050 [root] DEBUG: Successfully injected DLL C:\\2unxg6vp\\dll\\lvMMtOS.dll.\n2026-05-28 18:43:59,052 [lib.api.process] INFO: Injected into 64-bit <Process 9356 identity_helper.exe>\n2026-05-28 18:43:59,077 [root] DEBUG: 9356: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-28 18:43:59,079 [root] DEBUG: 9356: Interactive desktop enabled.\n2026-05-28 18:43:59,079 [root] DEBUG: 9356: Dropped file limit defaulting to 100.\n2026-05-28 18:43:59,084 [root] DEBUG: 9356: Disabling sleep skipping.\n2026-05-28 18:43:59,085 [root] DEBUG: 9356: YaraInit: Compiled rules loaded from existing file C:\\2unxg6vp\\data\\yara\\capemon.yac\n2026-05-28 18:43:59,096 [root] DEBUG: 9356: RtlInsertInvertedFunctionTable 0x00007FFF98C6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF98DBD4F0\n2026-05-28 18:43:59,097 [root] DEBUG: 9356: YaraScan: Scanning 0x00007FF61EFC0000, size 0x28b4d8\n2026-05-28 18:43:59,143 [root] DEBUG: 9356: Monitor initialised: 64-bit capemon loaded in process 9356 at 0x00007FFF52E70000, thread 9360, image base 0x00007FF61EFC0000, stack from 0x0000003FF8DD4000-0x0000003FF8DE0000\n2026-05-28 18:43:59,144 [root] DEBUG: 9356: Commandline: \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5452,i,6144736785640467952,18088932084502277173,524288 --field-trial-handle=2380,i,7766555859985167370,5263872035744863658,262144 --variations-seed-version --pseudonymization-salt-handle=2392,i,16352508375692784064,75618776120992641\n2026-05-28 18:43:59,144 [root] DEBUG: 9356: add_all_dlls_to_dll_ranges: skipping C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf.dll\n2026-05-28 18:43:59,156 [root] DEBUG: 9356: hook_api: LdrpCallInitRoutine export address 0x00007FFF98C699BC obtained via GetFunctionAddress\n2026-05-28 18:43:59,180 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'\n2026-05-28 18:43:59,181 [root] DEBUG: 9356: set_hooks: Unable to hook LockResource\n2026-05-28 18:43:59,186 [root] DEBUG: 9356: Hooked 627 out of 628 functions\n2026-05-28 18:43:59,193 [root] DEBUG: 6712: DLL loaded at 0x00007FFF95D10000: C:\\Windows\\SYSTEM32\\ncrypt (0x27000 bytes).\n2026-05-28 18:43:59,194 [root] DEBUG: 6712: DLL loaded at 0x00007FFF95CD0000: C:\\Windows\\SYSTEM32\\NTASN1 (0x3b000 bytes).\n2026-05-28 18:43:59,195 [root] DEBUG: 6712: DLL loaded at 0x00007FFF8E580000: C:\\Windows\\system32\\PCPKsp (0x118000 bytes).\n2026-05-28 18:43:59,199 [root] DEBUG: 6712: DLL loaded at 0x00007FFF98560000: C:\\Windows\\System32\\imagehlp (0x1d000 bytes).\n2026-05-28 18:43:59,200 [root] DEBUG: 6712: DLL loaded at 0x00007FFF8E460000: C:\\Windows\\SYSTEM32\\tbs (0x1b000 bytes).\n2026-05-28 18:43:59,201 [root] DEBUG: 6712: DLL loaded at 0x00007FFF834F0000: C:\\Windows\\system32\\ncryptprov (0x5a000 bytes).\n2026-05-28 18:43:59,203 [root] DEBUG: 9356: Syscall hook installed, syscall logging level 1\n2026-05-28 18:43:59,209 [root] DEBUG: 9356: RestoreHeaders: Restored original import table.\n2026-05-28 18:43:59,210 [root] INFO: Loaded monitor into process with pid 9356\n2026-05-28 18:43:59,210 [root] DEBUG: 9356: YaraScan: Scanning 0x00007FFF52500000, size 0x4b9994\n",
    "errors": []
  },
  "network": {
    "pcap_sha256": "e8e421b7fa8d5f23fc36f1cedb83ae06ca02de832ecefaff4ba94cf08d7123dc",
    "hosts": [
      {
        "ip": "150.171.28.12",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "199.232.191.82",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "13.107.246.31",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "162.159.128.233",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "162.159.138.234",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "162.159.136.234",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "4.237.153.9",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "23.202.165.215",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "23.216.117.82",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          80
        ]
      },
      {
        "ip": "23.211.129.205",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "172.64.41.3",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "104.16.80.73",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "static.cloudflareinsights.com",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "104.26.3.143",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "cdn.tailwindcss.com",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "185.247.139.200",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "sugarcraft.net",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "162.159.137.232",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "162.159.135.233",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "199.232.211.52",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "23.216.106.59",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "api.steampowered.com",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "199.232.215.52",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "149.135.84.160",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "steamconnecttest.com",
        "inaddrarpa": "",
        "ports": [
          80
        ]
      },
      {
        "ip": "172.172.255.217",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "205.196.6.132",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "103.10.125.22",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          27018
        ]
      },
      {
        "ip": "162.254.195.69",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          27018
        ]
      },
      {
        "ip": "162.254.195.75",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          27018
        ]
      },
      {
        "ip": "103.10.125.23",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          27018
        ]
      }
    ],
    "domains": [
      {
        "domain": "disabled.invalid",
        "ip": ""
      },
      {
        "domain": "api.steampowered.com",
        "ip": "23.216.106.59"
      },
      {
        "domain": "ipv6check-http.steamserver.net",
        "ip": ""
      },
      {
        "domain": "steamconnecttest.com",
        "ip": "23.56.110.51"
      },
      {
        "domain": "sugarcraft.net",
        "ip": "185.247.139.200"
      },
      {
        "domain": "cdn.tailwindcss.com",
        "ip": "104.26.3.143"
      },
      {
        "domain": "static.cloudflareinsights.com",
        "ip": "104.16.80.73"
      },
      {
        "domain": "dns.google",
        "ip": "8.8.4.4"
      },
      {
        "domain": "p2p-syd1.discovery.steamserver.net",
        "ip": "103.10.125.24"
      }
    ],
    "tcp": [
      {
        "src": "192.168.1.105",
        "sport": 49734,
        "dst": "8.8.4.4",
        "dport": 443,
        "offset": 1368,
        "time": 0.1893138885498047
      },
      {
        "src": "192.168.1.105",
        "sport": 49705,
        "dst": "103.10.125.22",
        "dport": 27018,
        "offset": 10284,
        "time": 0.7498610019683838
      },
      {
        "src": "192.168.1.105",
        "sport": 49739,
        "dst": "149.135.84.160",
        "dport": 80,
        "offset": 35929,
        "time": 1.7501060962677002
      },
      {
        "src": "192.168.1.105",
        "sport": 49738,
        "dst": "172.172.255.217",
        "dport": 443,
        "offset": 37268,
        "time": 2.5265159606933594
      },
      {
        "src": "192.168.1.105",
        "sport": 49729,
        "dst": "199.232.215.52",
        "dport": 443,
        "offset": 37522,
        "time": 2.6123099327087402
      },
      {
        "src": "192.168.1.105",
        "sport": 49740,
        "dst": "199.232.215.52",
        "dport": 443,
        "offset": 38451,
        "time": 2.626781940460205
      },
      {
        "src": "192.168.1.105",
        "sport": 49724,
        "dst": "199.232.211.52",
        "dport": 443,
        "offset": 472491,
        "time": 4.751960039138794
      },
      {
        "src": "192.168.1.105",
        "sport": 49741,
        "dst": "199.232.211.52",
        "dport": 443,
        "offset": 473103,
        "time": 4.766213893890381
      },
      {
        "src": "192.168.1.105",
        "sport": 49692,
        "dst": "162.159.135.233",
        "dport": 443,
        "offset": 778371,
        "time": 9.680298089981079
      },
      {
        "src": "192.168.1.105",
        "sport": 49694,
        "dst": "162.159.137.232",
        "dport": 443,
        "offset": 778722,
        "time": 11.461809873580933
      },
      {
        "src": "192.168.1.105",
        "sport": 49745,
        "dst": "52.123.252.240",
        "dport": 443,
        "offset": 1151110,
        "time": 13.646219968795776
      },
      {
        "src": "192.168.1.105",
        "sport": 49747,
        "dst": "150.171.28.11",
        "dport": 443,
        "offset": 1185861,
        "time": 13.690454959869385
      },
      {
        "src": "192.168.1.105",
        "sport": 49748,
        "dst": "104.26.3.143",
        "dport": 443,
        "offset": 1259011,
        "time": 14.410346984863281
      },
      {
        "src": "192.168.1.105",
        "sport": 49750,
        "dst": "104.16.80.73",
        "dport": 443,
        "offset": 1441771,
        "time": 14.576417922973633
      },
      {
        "src": "192.168.1.105",
        "sport": 49751,
        "dst": "142.250.195.227",
        "dport": 443,
        "offset": 1530358,
        "time": 14.810818910598755
      },
      {
        "src": "192.168.1.105",
        "sport": 49753,
        "dst": "142.250.195.227",
        "dport": 443,
        "offset": 1534016,
        "time": 14.811883926391602
      },
      {
        "src": "192.168.1.105",
        "sport": 49754,
        "dst": "142.250.195.227",
        "dport": 443,
        "offset": 1551736,
        "time": 14.82014799118042
      },
      {
        "src": "192.168.1.105",
        "sport": 49714,
        "dst": "162.159.61.3",
        "dport": 443,
        "offset": 4397667,
        "time": 16.642011880874634
      },
      {
        "src": "192.168.1.105",
        "sport": 49711,
        "dst": "8.8.4.4",
        "dport": 443,
        "offset": 4398274,
        "time": 16.833853006362915
      },
      {
        "src": "192.168.1.105",
        "sport": 49761,
        "dst": "162.159.61.3",
        "dport": 443,
        "offset": 16733293,
        "time": 18.53596305847168
      },
      {
        "src": "192.168.1.105",
        "sport": 49759,
        "dst": "8.8.8.8",
        "dport": 443,
        "offset": 16751138,
        "time": 18.544792890548706
      },
      {
        "src": "192.168.1.105",
        "sport": 49763,
        "dst": "8.8.4.4",
        "dport": 443,
        "offset": 16769357,
        "time": 18.56948709487915
      },
      {
        "src": "192.168.1.105",
        "sport": 49722,
        "dst": "23.211.129.205",
        "dport": 443,
        "offset": 16771474,
        "time": 18.594438076019287
      },
      {
        "src": "192.168.1.105",
        "sport": 49723,
        "dst": "23.216.106.59",
        "dport": 443,
        "offset": 16771685,
        "time": 18.61027693748474
      },
      {
        "src": "192.168.1.105",
        "sport": 49725,
        "dst": "199.232.211.52",
        "dport": 443,
        "offset": 16805892,
        "time": 18.75743007659912
      },
      {
        "src": "192.168.1.105",
        "sport": 49765,
        "dst": "150.171.28.11",
        "dport": 443,
        "offset": 16825067,
        "time": 21.124649047851562
      },
      {
        "src": "192.168.1.105",
        "sport": 49726,
        "dst": "23.211.129.205",
        "dport": 443,
        "offset": 16837595,
        "time": 21.173129081726074
      },
      {
        "src": "192.168.1.105",
        "sport": 49766,
        "dst": "23.216.106.59",
        "dport": 443,
        "offset": 16844140,
        "time": 21.241076946258545
      },
      {
        "src": "192.168.1.105",
        "sport": 49730,
        "dst": "199.232.215.52",
        "dport": 443,
        "offset": 16851179,
        "time": 21.366703987121582
      },
      {
        "src": "192.168.1.105",
        "sport": 49731,
        "dst": "23.216.106.59",
        "dport": 443,
        "offset": 16851407,
        "time": 21.4041109085083
      },
      {
        "src": "192.168.1.105",
        "sport": 49728,
        "dst": "199.232.211.52",
        "dport": 443,
        "offset": 16854049,
        "time": 21.441400051116943
      },
      {
        "src": "192.168.1.105",
        "sport": 49727,
        "dst": "199.232.215.52",
        "dport": 443,
        "offset": 16854190,
        "time": 21.45673394203186
      },
      {
        "src": "192.168.1.105",
        "sport": 49767,
        "dst": "103.10.125.23",
        "dport": 443,
        "offset": 16855115,
        "time": 21.51435399055481
      },
      {
        "src": "192.168.1.105",
        "sport": 49769,
        "dst": "103.10.125.23",
        "dport": 27018,
        "offset": 16855702,
        "time": 21.515716075897217
      },
      {
        "src": "192.168.1.105",
        "sport": 49768,
        "dst": "103.10.125.22",
        "dport": 27018,
        "offset": 16856289,
        "time": 21.51797890663147
      },
      {
        "src": "192.168.1.105",
        "sport": 49770,
        "dst": "162.254.195.75",
        "dport": 443,
        "offset": 16870612,
        "time": 21.626988887786865
      },
      {
        "src": "192.168.1.105",
        "sport": 49689,
        "dst": "199.232.191.82",
        "dport": 443,
        "offset": 16889566,
        "time": 25.526822090148926
      },
      {
        "src": "192.168.1.105",
        "sport": 49674,
        "dst": "172.172.255.217",
        "dport": 443,
        "offset": 16890057,
        "time": 28.80948305130005
      }
    ],
    "udp": [
      {
        "src": "192.168.1.105",
        "sport": 60943,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 9087,
        "time": 0.3274049758911133
      },
      {
        "src": "192.168.1.105",
        "sport": 55437,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 9745,
        "time": 0.35361409187316895
      },
      {
        "src": "192.168.1.105",
        "sport": 51608,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 21771,
        "time": 1.0627870559692383
      },
      {
        "src": "192.168.1.105",
        "sport": 54789,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 35331,
        "time": 1.5781869888305664
      },
      {
        "src": "192.168.1.105",
        "sport": 138,
        "dst": "192.168.1.255",
        "dport": 138,
        "offset": 480064,
        "time": 7.277216911315918
      },
      {
        "src": "192.168.1.105",
        "sport": 61791,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 1135000,
        "time": 13.587272882461548
      },
      {
        "src": "192.168.1.105",
        "sport": 59881,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 1135184,
        "time": 13.588600873947144
      },
      {
        "src": "192.168.1.105",
        "sport": 61055,
        "dst": "162.159.135.233",
        "dport": 443,
        "offset": 1135274,
        "time": 13.597608089447021
      },
      {
        "src": "192.168.1.105",
        "sport": 59049,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 1138335,
        "time": 13.607025861740112
      },
      {
        "src": "192.168.1.105",
        "sport": 56156,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 1144435,
        "time": 13.620629072189331
      },
      {
        "src": "192.168.1.105",
        "sport": 62235,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 1146343,
        "time": 13.62614393234253
      },
      {
        "src": "192.168.1.105",
        "sport": 52809,
        "dst": "185.247.139.200",
        "dport": 443,
        "offset": 1147600,
        "time": 13.636450052261353
      },
      {
        "src": "192.168.1.105",
        "sport": 58671,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 1155670,
        "time": 13.659286975860596
      },
      {
        "src": "192.168.1.105",
        "sport": 60799,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 1246154,
        "time": 14.374926090240479
      },
      {
        "src": "192.168.1.105",
        "sport": 58398,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 1246344,
        "time": 14.375509977340698
      },
      {
        "src": "192.168.1.105",
        "sport": 49168,
        "dst": "23.209.40.176",
        "dport": 443,
        "offset": 1247206,
        "time": 14.385957956314087
      },
      {
        "src": "192.168.1.105",
        "sport": 63916,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 1432808,
        "time": 14.531015872955322
      },
      {
        "src": "192.168.1.105",
        "sport": 62478,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 1461570,
        "time": 14.657459020614624
      },
      {
        "src": "192.168.1.105",
        "sport": 57378,
        "dst": "142.250.195.227",
        "dport": 443,
        "offset": 1462277,
        "time": 14.683351993560791
      },
      {
        "src": "192.168.1.105",
        "sport": 61347,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 16695876,
        "time": 18.498597860336304
      },
      {
        "src": "192.168.1.105",
        "sport": 61993,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 16696063,
        "time": 18.498876094818115
      },
      {
        "src": "192.168.1.105",
        "sport": 49630,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 16696250,
        "time": 18.499176025390625
      },
      {
        "src": "192.168.1.105",
        "sport": 54739,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 16696437,
        "time": 18.499398946762085
      },
      {
        "src": "192.168.1.105",
        "sport": 55895,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 16696624,
        "time": 18.499698877334595
      },
      {
        "src": "192.168.1.105",
        "sport": 61329,
        "dst": "8.8.8.8",
        "dport": 53,
        "offset": 16696811,
        "time": 18.499989986419678
      },
      {
        "src": "192.168.1.105",
        "sport": 49367,
        "dst": "162.159.61.3",
        "dport": 443,
        "offset": 16701146,
        "time": 18.52305006980896
      },
      {
        "src": "192.168.1.105",
        "sport": 55796,
        "dst": "162.159.61.3",
        "dport": 443,
        "offset": 16706854,
        "time": 18.525630950927734
      },
      {
        "src": "192.168.1.105",
        "sport": 51486,
        "dst": "8.8.8.8",
        "dport": 443,
        "offset": 16814206,
        "time": 21.093570947647095
      },
      {
        "src": "192.168.1.105",
        "sport": 27036,
        "dst": "192.168.1.255",
        "dport": 27036,
        "offset": 16886121,
        "time": 22.605427980422974
      }
    ],
    "icmp": [
      {
        "src": "192.168.1.105",
        "dst": "185.247.139.200",
        "type": 3,
        "data": ""
      }
    ],
    "http": [
      {
        "count": 1,
        "host": "steamconnecttest.com",
        "port": 80,
        "data": "GET /204 HTTP/1.1\r\nCache-Control: no-cache\r\nHost: steamconnecttest.com\r\nAccept: text/html,*/*;q=0.9\r\naccept-encoding: gzip,identity,*;q=0\r\naccept-charset: ISO-8859-1,utf-8,*;q=0.7\r\nuser-agent: Valve/Steam HTTP Client 1.0\r\n\r\n",
        "uri": "http://steamconnecttest.com/204",
        "body": "",
        "path": "/204",
        "user-agent": "Valve/Steam HTTP Client 1.0",
        "version": "1.1",
        "method": "GET",
        "first_seen": 1779993819.972242
      }
    ],
    "dns": [
      {
        "request": "disabled.invalid",
        "type": "A",
        "answers": [
          {
            "type": "NXDOMAIN",
            "data": ""
          }
        ],
        "first_seen": 1779993818.549541
      },
      {
        "request": "api.steampowered.com",
        "type": "A",
        "answers": [
          {
            "type": "A",
            "data": "23.216.106.59"
          }
        ],
        "first_seen": 1779993819.284923
      },
      {
        "request": "ipv6check-http.steamserver.net",
        "type": "A",
        "answers": [
          {
            "type": "CNAME",
            "data": "syd.http.ipv6check.akadns.net"
          },
          {
            "type": "CNAME",
            "data": "http.ipv6check.akadns.net"
          }
        ],
        "first_seen": 1779993819.405053
      },
      {
        "request": "steamconnecttest.com",
        "type": "A",
        "answers": [
          {
            "type": "A",
            "data": "149.135.84.160"
          },
          {
            "type": "A",
            "data": "149.135.84.155"
          }
        ],
        "first_seen": 1779993819.800323
      },
      {
        "request": "sugarcraft.net",
        "type": "A",
        "answers": [
          {
            "type": "A",
            "data": "185.247.139.200"
          }
        ],
        "first_seen": 1779993831.810737
      },
      {
        "request": "cdn.tailwindcss.com",
        "type": "A",
        "answers": [
          {
            "type": "A",
            "data": "104.26.2.143"
          },
          {
            "type": "A",
            "data": "172.67.68.11"
          },
          {
            "type": "A",
            "data": "104.26.3.143"
          }
        ],
        "first_seen": 1779993832.597342
      },
      {
        "request": "static.cloudflareinsights.com",
        "type": "A",
        "answers": [
          {
            "type": "A",
            "data": "104.16.79.73"
          },
          {
            "type": "A",
            "data": "104.16.80.73"
          }
        ],
        "first_seen": 1779993832.753291
      },
      {
        "request": "dns.google",
        "type": "A",
        "answers": [
          {
            "type": "A",
            "data": "8.8.8.8"
          },
          {
            "type": "A",
            "data": "8.8.4.4"
          }
        ],
        "first_seen": 1779993836.720734
      },
      {
        "request": "p2p-syd1.discovery.steamserver.net",
        "type": "A",
        "answers": [
          {
            "type": "A",
            "data": "103.10.125.24"
          },
          {
            "type": "A",
            "data": "103.10.125.42"
          }
        ],
        "first_seen": 1779993840.305092
      }
    ],
    "smtp": [],
    "irc": [],
    "dead_hosts": [
      [
        "162.254.195.75",
        27018
      ],
      [
        "162.254.195.69",
        27018
      ],
      [
        "205.196.6.132",
        443
      ],
      [
        "23.216.117.82",
        80
      ],
      [
        "23.202.165.215",
        443
      ],
      [
        "20.190.167.66",
        443
      ],
      [
        "192.168.1.105",
        49674
      ]
    ]
  },
  "url": {
    "whois": "Name: None\nCountry: None\nState: None\nCity: None\nZIP Code: None\nAddress: None\n\nOrginization: None\nDomain Name(s):\n    SUGARCRAFT.NET\nCreation Date:\n    2026-04-13 16:52:11\nUpdated Date:\n    2026-04-13 17:06:24\nExpiration Date:\n    2027-04-13 16:52:11\nEmail(s):\n    abuse-tracker@hostinger.com\n\nRegistrar(s):\n    HOSTINGER operations, UAB\nName Server(s):\n    DNS23.HOSTWARE.COM.TR\n    DNS24.HOSTWARE.COM.TR\nReferral URL(s):\n    None",
    "virustotal": {
      "error": true,
      "msg": "Unable to complete connection to VirusTotal. Status code: 429"
    }
  },
  "target": {
    "category": "url"
  },
  "url_analysis": {
    "url": "https://sugarcraft.net/"
  },
  "procmemory": [],
  "signatures": [
    {
      "name": "stealth_network",
      "description": "Network activity detected but not expressed in monitor API logs",
      "categories": [
        "stealth"
      ],
      "severity": 1,
      "weight": 1,
      "confidence": 100,
      "references": [],
      "data": [
        {
          "ip": "150.171.28.12"
        },
        {
          "ip": "199.232.191.82"
        },
        {
          "ip": "13.107.246.31"
        },
        {
          "ip": "162.159.128.233"
        },
        {
          "ip": "162.159.138.234"
        },
        {
          "ip": "162.159.136.234"
        },
        {
          "ip": "4.237.153.9"
        },
        {
          "ip": "23.202.165.215"
        },
        {
          "ip": "23.216.117.82"
        },
        {
          "ip": "23.211.129.205"
        },
        {
          "ip": "172.64.41.3"
        },
        {
          "ip": "104.16.80.73"
        },
        {
          "ip": "104.26.3.143"
        },
        {
          "ip": "185.247.139.200"
        },
        {
          "ip": "162.159.137.232"
        },
        {
          "ip": "162.159.135.233"
        },
        {
          "ip": "199.232.211.52"
        },
        {
          "ip": "23.216.106.59"
        },
        {
          "ip": "199.232.215.52"
        },
        {
          "ip": "149.135.84.160"
        },
        {
          "ip": "172.172.255.217"
        },
        {
          "ip": "205.196.6.132"
        },
        {
          "ip": "103.10.125.22"
        },
        {
          "ip": "162.254.195.69"
        },
        {
          "ip": "162.254.195.75"
        },
        {
          "ip": "103.10.125.23"
        },
        {
          "domain": "disabled.invalid"
        },
        {
          "domain": "api.steampowered.com"
        },
        {
          "domain": "ipv6check-http.steamserver.net"
        },
        {
          "domain": "steamconnecttest.com"
        },
        {
          "domain": "sugarcraft.net"
        },
        {
          "domain": "cdn.tailwindcss.com"
        },
        {
          "domain": "static.cloudflareinsights.com"
        },
        {
          "domain": "dns.google"
        },
        {
          "domain": "p2p-syd1.discovery.steamserver.net"
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "dllload_suspicious_directory",
      "description": "A DLL was loaded from a suspicious directory",
      "categories": [
        "side loading"
      ],
      "severity": 2,
      "weight": 1,
      "confidence": 50,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 6712,
          "cid": 121
        },
        {
          "suspicious_dll_load": "Process msedge.exe loaded a DLL from a suspicious directory, this is possibly indicative of DLL side loading/search order hijacking"
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "creates_suspended_process",
      "description": "Creates a process in a suspended state, likely for injection",
      "categories": [
        "injection",
        "process hollowing"
      ],
      "severity": 2,
      "weight": 1,
      "confidence": 50,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 6712,
          "cid": 102
        },
        {
          "type": "call",
          "pid": 6712,
          "cid": 107
        },
        {
          "type": "call",
          "pid": 6712,
          "cid": 119
        },
        {
          "type": "call",
          "pid": 6712,
          "cid": 120
        },
        {
          "type": "call",
          "pid": 6712,
          "cid": 136
        },
        {
          "type": "call",
          "pid": 6712,
          "cid": 140
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    }
  ],
  "malscore": 1.5,
  "ttps": [
    {
      "signature": "dllload_suspicious_directory",
      "ttps": [
        "T1574"
      ],
      "mbcs": [
        "F0015"
      ]
    },
    {
      "signature": "creates_suspended_process",
      "ttps": [
        "T1055"
      ],
      "mbcs": [
        "OC0006",
        "C0002"
      ]
    }
  ],
  "malstatus": "Clean"
}