{ "statistics": { "processing": [ { "name": "CAPE", "time": 0.0 }, { "name": "AnalysisInfo", "time": 0.017 }, { "name": "BehaviorAnalysis", "time": 0.183 }, { "name": "Debug", "time": 0.001 }, { "name": "NetworkAnalysis", "time": 1.693 }, { "name": "UrlAnalysis", "time": 1.833 }, { "name": "script_log_processing", "time": 0.001 }, { "name": "ProcessMemory", "time": 0.001 } ], "signatures": [ { "name": "packer_themida", "time": 0.0 }, { "name": "stealth_network", "time": 0.0 }, { "name": "disable_driver_via_blocklist", "time": 0.0 }, { "name": "disable_driver_via_hvcidisallowedimages", "time": 0.0 }, { "name": "disable_hypervisor_protected_code_integrity", "time": 0.0 }, { "name": "pendingfilerenameoperations_Operations", "time": 0.0 }, { "name": "anomalous_deletefile", "time": 0.0 }, { "name": "antiav_360_libs", "time": 0.0 }, { "name": "antiav_ahnlab_libs", "time": 0.0 }, { "name": "antiav_avast_libs", "time": 0.0 }, { "name": "antiav_bitdefender_libs", "time": 0.0 }, { "name": "antiav_bullguard_libs", "time": 0.0 }, { "name": "antiav_emsisoft_libs", "time": 0.0 }, { "name": "antiav_qurb_libs", "time": 0.0 }, { "name": "antiav_servicestop", "time": 0.0 }, { "name": "antiav_apioverride_libs", "time": 0.0 }, { "name": "antidebug_guardpages", "time": 0.0 }, { "name": "antidebug_ntcreatethreadex", "time": 0.0 }, { "name": "antiav_nthookengine_libs", "time": 0.0 }, { "name": "antidebug_outputdebugstring", "time": 0.0 }, { "name": "antidebug_setunhandledexceptionfilter", "time": 0.0 }, { "name": "antidebug_windows", "time": 0.0 }, { "name": "antisandbox_cuckoo", "time": 0.0 }, { "name": "antisandbox_cuckoocrash", "time": 0.0 }, { "name": "antisandbox_foregroundwindows", "time": 0.0 }, { "name": "antisandbox_mouse_hook", "time": 0.0 }, { "name": "mouse_movement_detect", "time": 0.0 }, { "name": "antisandbox_sboxie_libs", "time": 0.0 }, { "name": "antisandbox_sboxie_objects", "time": 0.0 }, { "name": "antisandbox_script_timer", "time": 0.0 }, { "name": "antisandbox_sleep", "time": 0.0 }, { "name": "antisandbox_sunbelt_libs", "time": 0.0 }, { "name": "antisandbox_unhook", "time": 0.0 }, { "name": "hardware_id_profiling", "time": 0.0 }, { "name": "antivm_directory_objects", "time": 0.0 }, { "name": "antivm_display", "time": 0.0 }, { "name": "antivm_generic_disk", "time": 0.0 }, { "name": "antivm_generic_scsi", "time": 0.0 }, { "name": "antivm_generic_services", "time": 0.0 }, { "name": "antivm_generic_system", "time": 0.0 }, { "name": "antivm_checks_available_memory", "time": 0.0 }, { "name": "detect_virtualization_via_recent_files", "time": 0.0 }, { "name": "antivm_vbox_libs", "time": 0.0 }, { "name": "antivm_vbox_window", "time": 0.0 }, { "name": "antivm_vmware_events", "time": 0.0 }, { "name": "antivm_vmware_libs", "time": 0.0 }, { "name": "antivm_wmi", "time": 0.0 }, { "name": "api_spamming", "time": 0.0 }, { "name": "api_uuidfromstringa", "time": 0.0 }, { "name": "bcdedit_command", "time": 0.0 }, { "name": "bootkit", "time": 0.0 }, { "name": "direct_hdd_access", "time": 0.0 }, { "name": "physical_drive_access", "time": 0.0 }, { "name": "potential_overwrite_mbr", "time": 0.0 }, { "name": "read_file_raw_disk_access", "time": 0.0 }, { "name": "suspicious_iocontrol_codes", "time": 0.0 }, { "name": "browser_needed", "time": 0.0 }, { "name": "firefox_disables_process_tab", "time": 0.0 }, { "name": "amsi_enumeration", "time": 0.0 }, { "name": "regsvr32_squiblydoo_dll_load", "time": 0.0 }, { "name": "suspicious_ntdll_disk_load", "time": 0.0 }, { "name": "direct_syscall_evasion", "time": 0.0 }, { "name": "unbacked_syscall_execution", "time": 0.0 }, { "name": "uac_bypass_cmstp", "time": 0.0 }, { "name": "uac_bypass_eventvwr", "time": 0.0 }, { "name": "uac_bypass_windows_Backup", "time": 0.0 }, { "name": "privilege_elevation_check", "time": 0.0 }, { "name": "queries_computer_name", "time": 0.0 }, { "name": "queries_user_name", "time": 0.0 }, { "name": "creates_largekey", "time": 0.0 }, { "name": "creates_nullvalue", "time": 0.0 }, { "name": "access_windows_passwords_vault", "time": 0.0 }, { "name": "dump_lsa_via_windows_error_reporting", "time": 0.0 }, { "name": "lsass_credential_dumping", "time": 0.0 }, { "name": "critical_process", "time": 0.0 }, { "name": "query_fips_reconnaissance", "time": 0.0 }, { "name": "cryptopool_domains", "time": 0.0 }, { "name": "dead_connect", "time": 0.0 }, { "name": "dead_link", "time": 0.0 }, { "name": "debugs_self", "time": 0.0 }, { "name": "decoy_image", "time": 0.0 }, { "name": "deletes_consolehost_history", "time": 0.0 }, { "name": "deletes_shadow_copies", "time": 0.0 }, { "name": "deletes_system_state_backup", "time": 0.0 }, { "name": "dep_bypass", "time": 0.0 }, { "name": "dep_disable", "time": 0.0 }, { "name": "disables_mappeddrives_autodisconnect", "time": 0.0 }, { "name": "disables_spdy", "time": 0.0 }, { "name": "disables_wfp", "time": 0.0 }, { "name": "add_windows_defender_exclusions", "time": 0.0 }, { "name": "mountpoints_volume_discovery", "time": 0.0 }, { "name": "dll_load_uncommon_file_types", "time": 0.0 }, { "name": "dllload_suspicious_directory", "time": 0.0 }, { "name": "document_script_exe_drop", "time": 0.0 }, { "name": "driver_load", "time": 0.0 }, { "name": "install_kernel_driver_service", "time": 0.0 }, { "name": "malformed_dll_loading", "time": 0.0 }, { "name": "dynamic_function_loading", "time": 0.0 }, { "name": "registers_vectored_exception_handler", "time": 0.0 }, { "name": "exec_crash", "time": 0.0 }, { "name": "process_creation_suspicious_location", "time": 0.0 }, { "name": "exploit_getbasekerneladdress", "time": 0.0 }, { "name": "exploit_gethaldispatchtable", "time": 0.0 }, { "name": "exploit_heapspray", "time": 0.0 }, { "name": "downloads_from_filehosting", "time": 0.0 }, { "name": "generic_phish", "time": 0.0 }, { "name": "http_request", "time": 0.0 }, { "name": "infostealer_browser", "time": 0.0 }, { "name": "infostealer_browser_password", "time": 0.0 }, { "name": "infostealer_cookies", "time": 0.0 }, { "name": "infostealer_keylog", "time": 0.0 }, { "name": "captures_screenshot", "time": 0.0 }, { "name": "injection_createremotethread", "time": 0.0 }, { "name": "creates_suspended_process", "time": 0.0 }, { "name": "injection_explorer", "time": 0.0 }, { "name": "injection_module_stomping_probing", "time": 0.0 }, { "name": "injection_needextension", "time": 0.0 }, { "name": "injection_network_traffic", "time": 0.0 }, { "name": "injection_runpe", "time": 0.0 }, { "name": "section_mapping_injection", "time": 0.0 }, { "name": "injection_themeinitapihook", "time": 0.0 }, { "name": "apc_injection", "time": 0.0 }, { "name": "resumethread_remote_process", "time": 0.0 }, { "name": "injection_write_exe_process", "time": 0.0 }, { "name": "injection_write_process", "time": 0.0 }, { "name": "internet_dropper", "time": 0.0 }, { "name": "interprocess_comms_mutex", "time": 0.0 }, { "name": "interprocess_comms_named_pipe", "time": 0.0 }, { "name": "interprocess_comms_shared_memory", "time": 0.0 }, { "name": "escalate_privilege_via_named_pipe", "time": 0.0 }, { "name": "ipc_namedpipe", "time": 0.0 }, { "name": "js_phish", "time": 0.0 }, { "name": "js_suspicious_redirect", "time": 0.0 }, { "name": "execute_binary_via_internet_explorer_exporter", "time": 0.0 }, { "name": "execute_binary_via_run_exe_helper_utility", "time": 0.0 }, { "name": "execute_ps_via_syncappvpublishingserver", "time": 0.0 }, { "name": "malicious_dynamic_function_loading", "time": 0.0 }, { "name": "reads_memory_remote_process", "time": 0.0 }, { "name": "unbacked_exception_filter", "time": 0.0 }, { "name": "unbacked_process_mitigation_alteration", "time": 0.0 }, { "name": "thread_unbacked_memory", "time": 0.0 }, { "name": "unbacked_api_resolution", "time": 0.0 }, { "name": "unbacked_dotnet_execution", "time": 0.0 }, { "name": "unbacked_library_load", "time": 0.0 }, { "name": "unbacked_memory_apc_execution", "time": 0.0 }, { "name": "unbacked_memory_protection_alteration", "time": 0.0 }, { "name": "unbacked_mutex_creation", "time": 0.0 }, { "name": "unbacked_process_creation", "time": 0.0 }, { "name": "unbacked_veh_registration", "time": 0.0 }, { "name": "unbacked_com_instantiation", "time": 0.0 }, { "name": "unbacked_crypto_operations", "time": 0.0 }, { "name": "unbacked_delay_execution", "time": 0.0 }, { "name": "unbacked_file_dropping", "time": 0.0 }, { "name": "unbacked_process_enumeration", "time": 0.0 }, { "name": "unbacked_registry_modification", "time": 0.0 }, { "name": "unbacked_service_manipulation", "time": 0.0 }, { "name": "unbacked_token_manipulation", "time": 0.0 }, { "name": "unbacked_wmi_execution", "time": 0.0 }, { "name": "unbacked_bind_shell", "time": 0.0 }, { "name": "unbacked_dns_resolution", "time": 0.0 }, { "name": "unbacked_memory_network_connection", "time": 0.0 }, { "name": "unbacked_named_pipe_creation", "time": 0.0 }, { "name": "unbacked_useragent_retrieval", "time": 0.0 }, { "name": "mimics_filetime", "time": 0.0 }, { "name": "amsi_bypass_via_com_registry", "time": 0.0 }, { "name": "access_auto_logons_via_registry", "time": 0.0 }, { "name": "access_boot_key_via_registry", "time": 0.0 }, { "name": "create_suspicious_lnk_files", "time": 0.0 }, { "name": "credential_access_via_windows_credential_history", "time": 0.0 }, { "name": "dll_hijacking_via_microsoft_exchange", "time": 0.0 }, { "name": "dll_hijacking_via_waas_medic_svc_com_typelib", "time": 0.0 }, { "name": "execute_file_downloaded_via_openssh", "time": 0.0 }, { "name": "execute_safe_mode_from_suspicious_process", "time": 0.0 }, { "name": "execute_scripts_via_microsoft_management_console", "time": 0.0 }, { "name": "execute_suspicious_processes_via_windows_mssql_service", "time": 0.0 }, { "name": "execution_from_self_extracting_archive", "time": 0.0 }, { "name": "ip_address_discovery_via_trusted_program", "time": 0.0 }, { "name": "load_dll_via_control_panel", "time": 0.0 }, { "name": "network_connection_via_suspicious_process", "time": 0.0 }, { "name": "potential_location_discovery_via_unusual_process", "time": 0.0 }, { "name": "store_executable_registry", "time": 0.0 }, { "name": "Suspicious_Execution_Via_MicrosoftExchangeTransportAgent", "time": 0.0 }, { "name": "suspicious_java_execution_via_win_scripts", "time": 0.0 }, { "name": "Suspicious_Scheduled_Task_Creation_Via_Masqueraded_XML_File", "time": 0.0 }, { "name": "uses_restart_manager_for_suspicious_activities", "time": 0.0 }, { "name": "modify_desktop_wallpaper", "time": 0.0 }, { "name": "modify_zoneid_ads", "time": 0.0 }, { "name": "move_file_on_reboot", "time": 0.0 }, { "name": "multiple_useragents", "time": 0.0 }, { "name": "network_anomaly", "time": 0.0 }, { "name": "network_bind", "time": 0.0 }, { "name": "etherhiding_smart_contract_call", "time": 0.0 }, { "name": "network_cnc_https_archive", "time": 0.0 }, { "name": "network_cnc_https_free_webhosting", "time": 0.0 }, { "name": "network_cnc_https_generic", "time": 0.0 }, { "name": "network_cnc_https_interactsh", "time": 0.0 }, { "name": "network_cnc_https_opensource", "time": 0.0 }, { "name": "network_cnc_https_pastesite", "time": 0.0 }, { "name": "network_cnc_https_payload", "time": 0.0 }, { "name": "network_cnc_https_serviceinterface", "time": 0.0 }, { "name": "network_cnc_https_socialmedia", "time": 0.0 }, { "name": "network_cnc_https_telegram", "time": 0.0 }, { "name": "network_cnc_https_tempstorage", "time": 0.0 }, { "name": "network_cnc_https_temp_urldns", "time": 0.0 }, { "name": "network_cnc_https_urlshortener", "time": 0.0 }, { "name": "network_cnc_https_useragent", "time": 0.0 }, { "name": "network_cnc_smtps_exfil", "time": 0.0 }, { "name": "network_cnc_smtps_generic", "time": 0.0 }, { "name": "network_dns_idn", "time": 0.0 }, { "name": "network_dns_suspicious_querytype", "time": 0.0 }, { "name": "network_dns_tunneling_request", "time": 0.0 }, { "name": "explorer_http", "time": 0.0 }, { "name": "network_fake_useragent", "time": 0.0 }, { "name": "legitimate_domain_abuse", "time": 0.0 }, { "name": "suspicious_communication_trusted_site", "time": 0.0 }, { "name": "network_tor", "time": 0.0 }, { "name": "office_com_load", "time": 0.0 }, { "name": "office_dotnet_load", "time": 0.0 }, { "name": "office_mshtml_load", "time": 0.0 }, { "name": "office_vb_load", "time": 0.0 }, { "name": "office_wmi_load", "time": 0.0 }, { "name": "office_cve2017_11882_network", "time": 0.0 }, { "name": "office_cve_2021_40444", "time": 0.0 }, { "name": "office_cve_2021_40444_m2", "time": 0.0 }, { "name": "office_flash_load", "time": 0.0 }, { "name": "office_postscript", "time": 0.0 }, { "name": "office_suspicious_processes", "time": 0.0 }, { "name": "decompress_exe", "time": 0.0 }, { "name": "persistence_via_autodial_dll_registry", "time": 0.0 }, { "name": "persistence_autorun", "time": 0.0 }, { "name": "persistence_autorun_tasks", "time": 0.0 }, { "name": "persistence_bootexecute", "time": 0.0 }, { "name": "persistence_registry_script", "time": 0.0 }, { "name": "powershell_download", "time": 0.0 }, { "name": "powershell_request", "time": 0.0 }, { "name": "createtoolhelp32snapshot_module_enumeration", "time": 0.0 }, { "name": "enumerates_running_processes", "time": 0.0 }, { "name": "process_interest", "time": 0.0 }, { "name": "process_needed", "time": 0.0 }, { "name": "ransomware_iocp_asynchronous_encryption", "time": 0.0 }, { "name": "kernel_crypto_driver_abuse", "time": 0.0 }, { "name": "mass_data_encryption", "time": 0.0 }, { "name": "ransomware_extension_hijack", "time": 0.0 }, { "name": "mass_file_modification_access", "time": 0.0 }, { "name": "ransomware_attribute_stripping", "time": 0.0 }, { "name": "ransomware_file_modifications", "time": 0.0 }, { "name": "mass_ransom_note_drop", "time": 0.0 }, { "name": "ransomware_message", "time": 0.0 }, { "name": "recon_beacon", "time": 0.0 }, { "name": "recon_programs", "time": 0.0 }, { "name": "recon_systeminfo", "time": 0.0 }, { "name": "accesses_recyclebin", "time": 0.0 }, { "name": "script_created_process", "time": 0.0 }, { "name": "script_network_activity", "time": 0.0 }, { "name": "suspicious_js_script", "time": 0.0 }, { "name": "javascript_timer", "time": 0.0 }, { "name": "secure_login_phishing", "time": 0.0 }, { "name": "securityxploded_modules", "time": 0.0 }, { "name": "get_clipboard_data", "time": 0.0 }, { "name": "sets_autoconfig_url", "time": 0.0 }, { "name": "spoofs_procname", "time": 0.0 }, { "name": "stack_pivot", "time": 0.0 }, { "name": "stack_pivot_file_created", "time": 0.0 }, { "name": "stack_pivot_process_create", "time": 0.0 }, { "name": "set_clipboard_data", "time": 0.0 }, { "name": "stealth_childproc", "time": 0.0 }, { "name": "stealth_system_procname", "time": 0.0 }, { "name": "stealth_timeout", "time": 0.0 }, { "name": "stealth_window", "time": 0.0 }, { "name": "queries_keyboard_layout", "time": 0.0 }, { "name": "queries_locale_api", "time": 0.0 }, { "name": "terminates_remote_process", "time": 0.0 }, { "name": "uiautomationcore_load", "time": 0.0 }, { "name": "user_enum", "time": 0.0 }, { "name": "mmc_dll_script_load", "time": 0.0 }, { "name": "mmc_dotnet_load", "time": 0.0 }, { "name": "virus", "time": 0.0 }, { "name": "webmail_phish", "time": 0.0 }, { "name": "persists_dev_util", "time": 0.0 }, { "name": "spawns_dev_util", "time": 0.0 }, { "name": "alters_windows_utility", "time": 0.0 }, { "name": "overwrites_accessibility_utility", "time": 0.0 }, { "name": "Potential_Lateral_Movement_Via_SMBEXEC", "time": 0.0 }, { "name": "potential_WebShell_Via_ScreenConnectServer", "time": 0.0 }, { "name": "uses_Microsoft_HTML_Help_Executable", "time": 0.0 }, { "name": "wiper_zeroedbytes", "time": 0.0 }, { "name": "wmi_create_process", "time": 0.0 }, { "name": "wmi_script_process", "time": 0.0 }, { "name": "deletes_files", "time": 0.0 }, { "name": "drops_files", "time": 0.0 }, { "name": "reads_files", "time": 0.0 }, { "name": "writes_files", "time": 0.0 }, { "name": "antianalysis_tls_section", "time": 0.0 }, { "name": "antivirus_clamav", "time": 0.0 }, { "name": "antivirus_virustotal", "time": 0.0 }, { "name": "bad_certs", "time": 0.0 }, { "name": "bad_ssl_certs", "time": 0.0 }, { "name": "banker_zeus_p2p", "time": 0.0 }, { "name": "banker_zeus_url", "time": 0.0 }, { "name": "bot_athenahttp", "time": 0.0 }, { "name": "bot_dirtjumper", "time": 0.0 }, { "name": "bot_drive", "time": 0.0 }, { "name": "bot_drive2", "time": 0.0 }, { "name": "bot_madness", "time": 0.0 }, { "name": "byod_loldrivers_match", "time": 0.0 }, { "name": "byod_novel_driver", "time": 0.0 }, { "name": "byod_post_load_exploitation", "time": 0.0 }, { "name": "byod_driver_service_install", "time": 0.0 }, { "name": "com_spawned_process", "time": 0.0 }, { "name": "family_proxyback", "time": 0.0 }, { "name": "flare_capa_antianalysis", "time": 0.0 }, { "name": "flare_capa_collection", "time": 0.0 }, { "name": "flare_capa_communication", "time": 0.0 }, { "name": "flare_capa_compiler", "time": 0.0 }, { "name": "flare_capa_datamanipulation", "time": 0.0 }, { "name": "flare_capa_executable", "time": 0.0 }, { "name": "flare_capa_hostinteraction", "time": 0.0 }, { "name": "flare_capa_impact", "time": 0.0 }, { "name": "flare_capa_lib", "time": 0.0 }, { "name": "flare_capa_linking", "time": 0.0 }, { "name": "flare_capa_loadcode", "time": 0.0 }, { "name": "flare_capa_malwarefamily", "time": 0.0 }, { "name": "flare_capa_nursery", "time": 0.0 }, { "name": "flare_capa_persistence", "time": 0.0 }, { "name": "flare_capa_runtime", "time": 0.0 }, { "name": "flare_capa_targeting", "time": 0.0 }, { "name": "threatfox", "time": 0.0 }, { "name": "log4shell", "time": 0.0 }, { "name": "mimics_extension", "time": 0.0 }, { "name": "network_ip_exe", "time": 0.0 }, { "name": "network_dga", "time": 0.0 }, { "name": "network_dga_fraunhofer", "time": 0.0 }, { "name": "network_dyndns", "time": 0.001 }, { "name": "network_icmp", "time": 0.0 }, { "name": "network_irc", "time": 0.0 }, { "name": "network_open_proxy", "time": 0.0 }, { "name": "network_smtp", "time": 0.0 }, { "name": "network_torgateway", "time": 0.0 }, { "name": "origin_langid", "time": 0.0 }, { "name": "origin_resource_langid", "time": 0.0 }, { "name": "overlay", "time": 0.0 }, { "name": "pe_deep_entrypoint", "time": 0.0 }, { "name": "packer_unknown_pe_section_name", "time": 0.0 }, { "name": "packer_aspack", "time": 0.0 }, { "name": "packer_aspirecrypt", "time": 0.0 }, { "name": "packer_bedsprotector", "time": 0.0 }, { "name": "packer_confuser", "time": 0.0 }, { "name": "packer_enigma", "time": 0.0 }, { "name": "packer_entropy", "time": 0.0 }, { "name": "packer_mpress", "time": 0.0 }, { "name": "packer_nate", "time": 0.0 }, { "name": "packer_nspack", "time": 0.0 }, { "name": "packer_smartassembly", "time": 0.0 }, { "name": "packer_spices", "time": 0.0 }, { "name": "packer_themida", "time": 0.0 }, { "name": "packer_titan", "time": 0.0 }, { "name": "packer_upx", "time": 0.0 }, { "name": "packer_vmprotect", "time": 0.0 }, { "name": "packer_yoda", "time": 0.0 }, { "name": "pe_cert_invalid_signature", "time": 0.0 }, { "name": "pe_cert_self_signed", "time": 0.0 }, { "name": "pe_cert_suspicious_issuer", "time": 0.0 }, { "name": "punch_plus_plus_pcres", "time": 0.0 }, { "name": "procmem_yara", "time": 0.0 }, { "name": "recon_checkip", "time": 0.0 }, { "name": "sigma_events", "time": 0.0 }, { "name": "static_authenticode", "time": 0.0 }, { "name": "invalid_authenticode_signature", "time": 0.0 }, { "name": "static_dotnet_anomaly", "time": 0.0 }, { "name": "static_java", "time": 0.0 }, { "name": "static_pdf", "time": 0.0 }, { "name": "contains_pe_overlay", "time": 0.0 }, { "name": "static_pe_anomaly", "time": 0.0 }, { "name": "pe_compile_timestomping", "time": 0.0 }, { "name": "static_pe_pdbpath", "time": 0.0 }, { "name": "static_rat_config", "time": 0.0 }, { "name": "static_versioninfo_anomaly", "time": 0.0 }, { "name": "browser_credential_theft_headless", "time": 0.0 }, { "name": "suricata_alert", "time": 0.0 }, { "name": "volatility_devicetree_1", "time": 0.0 }, { "name": "volatility_handles_1", "time": 0.0 }, { "name": "volatility_ldrmodules_1", "time": 0.0 }, { "name": "volatility_ldrmodules_2", "time": 0.0 }, { "name": "volatility_malfind_1", "time": 0.0 }, { "name": "volatility_malfind_2", "time": 0.0 }, { "name": "volatility_modscan_1", "time": 0.0 }, { "name": "volatility_svcscan_1", "time": 0.0 }, { "name": "volatility_svcscan_2", "time": 0.0 }, { "name": "volatility_svcscan_3", "time": 0.0 }, { "name": "whois_create", "time": 0.0 }, { "name": "accesses_mailslot", "time": 0.0 }, { "name": "accesses_netlogon_regkey", "time": 0.0 }, { "name": "accesses_public_folder", "time": 0.0 }, { "name": "accesses_sysvol", "time": 0.0 }, { "name": "writes_sysvol", "time": 0.0 }, { "name": "adds_admin_user", "time": 0.0 }, { "name": "adds_user", "time": 0.0 }, { "name": "overwrites_admin_password", "time": 0.0 }, { "name": "antianalysis_detectfile", "time": 0.002 }, { "name": "antianalysis_detectreg", "time": 0.032 }, { "name": "modify_attachment_manager", "time": 0.0 }, { "name": "antiav_detectfile", "time": 0.004 }, { "name": "antiav_detectreg", "time": 0.154 }, { "name": "antiav_srp", "time": 0.0 }, { "name": "antiav_whitespace", "time": 0.0 }, { "name": "antidebug_devices", "time": 0.001 }, { "name": "antiemu_windefend", "time": 0.0 }, { "name": "antiemu_wine_reg", "time": 0.0 }, { "name": "antisandbox_cuckoo_files", "time": 0.0 }, { "name": "antisandbox_fortinet_files", "time": 0.0 }, { "name": "antisandbox_joe_anubis_files", "time": 0.0 }, { "name": "antisandbox_sboxie_mutex", "time": 0.0 }, { "name": "antisandbox_sunbelt_files", "time": 0.0 }, { "name": "antisandbox_threattrack_files", "time": 0.0 }, { "name": "antivm_bochs_keys", "time": 0.003 }, { "name": "antivm_generic_bios", "time": 0.002 }, { "name": "antivm_generic_diskreg", "time": 0.006 }, { "name": "antivm_hyperv_keys", "time": 0.003 }, { "name": "antivm_parallels_keys", "time": 0.009 }, { "name": "antivm_recentdocs", "time": 0.0 }, { "name": "antivm_vbox_devices", "time": 0.0 }, { "name": "antivm_vbox_files", "time": 0.002 }, { "name": "antivm_vbox_keys", "time": 0.017 }, { "name": "antivm_vmware_devices", "time": 0.0 }, { "name": "antivm_vmware_files", "time": 0.001 }, { "name": "antivm_vmware_keys", "time": 0.011 }, { "name": "antivm_vmware_mutexes", "time": 0.0 }, { "name": "antivm_vpc_files", "time": 0.0 }, { "name": "antivm_vpc_keys", "time": 0.006 }, { "name": "antivm_vpc_mutex", "time": 0.0 }, { "name": "antivm_xen_keys", "time": 0.008 }, { "name": "ketrican_regkeys", "time": 0.001 }, { "name": "bitcoin_opencl", "time": 0.0 }, { "name": "enumerates_physical_drives", "time": 0.0 }, { "name": "bot_russkill", "time": 0.0 }, { "name": "browser_addon", "time": 0.0 }, { "name": "chromium_browser_extension_directory", "time": 0.0 }, { "name": "browser_helper_object", "time": 0.0 }, { "name": "browser_security", "time": 0.0 }, { "name": "browser_startpage", "time": 0.0 }, { "name": "executes_headless_browser", "time": 0.0 }, { "name": "suspicious_browser_arguments", "time": 0.0 }, { "name": "ie_disables_process_tab", "time": 0.0 }, { "name": "odbcconf_bypass", "time": 0.003 }, { "name": "squiblydoo_bypass", "time": 0.0 }, { "name": "squiblytwo_bypass", "time": 0.0 }, { "name": "bypass_chromium_protection", "time": 0.0 }, { "name": "bypass_firewall", "time": 0.003 }, { "name": "checks_uac_status", "time": 0.0 }, { "name": "uac_bypass_cmstpcom", "time": 0.001 }, { "name": "uac_bypass_delegateexecute_sdclt", "time": 0.0 }, { "name": "uac_bypass_fodhelper", "time": 0.0 }, { "name": "cape_extracted_content", "time": 0.0 }, { "name": "clears_logs", "time": 0.0 }, { "name": "cmdline_obfuscation", "time": 0.0 }, { "name": "cmdline_switches", "time": 0.0 }, { "name": "cmdline_terminate", "time": 0.0 }, { "name": "cmdline_forfiles_wildcard", "time": 0.0 }, { "name": "cmdline_http_link", "time": 0.0 }, { "name": "cmdline_long_string", "time": 0.0 }, { "name": "cmdline_reversed_http_link", "time": 0.0 }, { "name": "long_commandline", "time": 0.0 }, { "name": "powershell_renamed_commandline", "time": 0.0 }, { "name": "copies_self", "time": 0.0 }, { "name": "credwiz_credentialaccess", "time": 0.0 }, { "name": "enables_wdigest", "time": 0.0 }, { "name": "vaultcmd_credentialaccess", "time": 0.0 }, { "name": "file_credential_store_access", "time": 0.0 }, { "name": "file_credential_store_write", "time": 0.0 }, { "name": "kerberos_credential_access_via_rubeus", "time": 0.0 }, { "name": "registry_credential_dumping", "time": 0.0 }, { "name": "registry_lsa_secrets_access", "time": 0.0 }, { "name": "comsvcs_credentialdump", "time": 0.0 }, { "name": "cryptomining_stratum_command", "time": 0.0 }, { "name": "deepfreeze_mutex", "time": 0.0 }, { "name": "deletes_executed_files", "time": 0.0 }, { "name": "disables_app_launch", "time": 0.0 }, { "name": "disables_auto_app_termination", "time": 0.0 }, { "name": "disables_appv_virtualization", "time": 0.0 }, { "name": "disables_backups", "time": 0.0 }, { "name": "disables_browser_warn", "time": 0.0 }, { "name": "disables_context_menus", "time": 0.0 }, { "name": "disables_cpl_disable", "time": 0.0 }, { "name": "disables_crashdumps", "time": 0.0 }, { "name": "disables_event_logging", "time": 0.0 }, { "name": "disables_folder_options", "time": 0.0 }, { "name": "disables_notificationcenter", "time": 0.0 }, { "name": "disables_power_options", "time": 0.0 }, { "name": "disables_restore_default_state", "time": 0.0 }, { "name": "disables_run_command", "time": 0.0 }, { "name": "disables_smartscreen", "time": 0.0 }, { "name": "disables_startmenu_search", "time": 0.0 }, { "name": "disables_system_restore", "time": 0.0 }, { "name": "disables_uac", "time": 0.0 }, { "name": "disables_wer", "time": 0.0 }, { "name": "disables_windows_defender", "time": 0.0 }, { "name": "disables_windows_defender_logging", "time": 0.002 }, { "name": "removes_windows_defender_contextmenu", "time": 0.002 }, { "name": "removes_windows_defender_updates", "time": 0.0 }, { "name": "windows_defender_powershell", "time": 0.0 }, { "name": "disables_windows_file_protection", "time": 0.0 }, { "name": "disables_windowsupdate", "time": 0.0 }, { "name": "disables_winfirewall", "time": 0.0 }, { "name": "folder_enumeration", "time": 0.0 }, { "name": "discover_registry_mount_points", "time": 0.0 }, { "name": "adfind_domain_enumeration", "time": 0.0 }, { "name": "domain_enumeration_commands", "time": 0.0 }, { "name": "driver_filtermanager", "time": 0.0 }, { "name": "dropper", "time": 0.0 }, { "name": "dll_archive_execution", "time": 0.0 }, { "name": "lnk_archive_execution", "time": 0.0 }, { "name": "script_archive_execution", "time": 0.0 }, { "name": "excel4_macro_urls", "time": 0.0 }, { "name": "escalate_privilege_via_ntlm_relay", "time": 0.0 }, { "name": "spooler_access", "time": 0.0 }, { "name": "spooler_svc_start", "time": 0.0 }, { "name": "mapped_drives_uac", "time": 0.0 }, { "name": "hides_recycle_bin_icon", "time": 0.0 }, { "name": "infostealer_bitcoin", "time": 0.002 }, { "name": "infostealer_ftp", "time": 0.053 }, { "name": "infostealer_im", "time": 0.03 }, { "name": "infostealer_mail", "time": 0.006 }, { "name": "Evade_Execution_Via_ASPNet_Compiler", "time": 0.0 }, { "name": "Evade_Execute_Via_DeviceCredentialDeployment", "time": 0.0 }, { "name": "Evade_Execution_Via_Filter_Manager_Control", "time": 0.0 }, { "name": "Evade_Execution_Via_Intel_GFXDownloadWrapper", "time": 0.0 }, { "name": "execute_binary_via_appvlp", "time": 0.0 }, { "name": "execute_binary_via_pcalua", "time": 0.0 }, { "name": "Execute_Binary_Via_OpenSSH", "time": 0.0 }, { "name": "execute_binary_via_pcalua", "time": 0.0 }, { "name": "Execute_Binary_Via_PesterPSModule", "time": 0.0 }, { "name": "Execute_Binary_Via_ScriptRunner", "time": 0.0 }, { "name": "execute_binary_via_ttdinject", "time": 0.0 }, { "name": "Execute_Binary_Via_VisualStudioLiveShare", "time": 0.0 }, { "name": "Execute_Msiexec_Via_Explorer", "time": 0.0 }, { "name": "execute_remote_msi", "time": 0.0 }, { "name": "execute_suspicious_powershell_via_runscripthelper", "time": 0.0 }, { "name": "execute_suspicious_powershell_via_sqlps", "time": 0.0 }, { "name": "Indirect_Command_Execution_Via_ConsoleWindowHost", "time": 0.0 }, { "name": "Perform_Malicious_Activities_Via_Headless_Browser", "time": 0.0 }, { "name": "Register_DLL_Via_CertOC", "time": 0.0 }, { "name": "Register_DLL_Via_MSIEXEC", "time": 0.0 }, { "name": "Register_DLL_Via_Odbcconf", "time": 0.0 }, { "name": "Scriptlet_Proxy_Execution_Via_Pubprn", "time": 0.0 }, { "name": "ie_martian_children", "time": 0.0 }, { "name": "office_martian_children", "time": 0.0 }, { "name": "mimics_icon", "time": 0.0 }, { "name": "masquerade_process_name", "time": 0.005 }, { "name": "mimikatz_modules", "time": 0.0 }, { "name": "ms_office_cmd_rce", "time": 0.0 }, { "name": "mount_copy_to_webdav_share", "time": 0.0 }, { "name": "potential_protocol_tunneling_via_legit_utilities", "time": 0.0 }, { "name": "potential_protocol_tunneling_via_qemu", "time": 0.0 }, { "name": "suspicious_execution_via_dotnet_remoting", "time": 0.0 }, { "name": "dotnet_clr_usagelog_regkeys", "time": 0.0 }, { "name": "modify_hostfile", "time": 0.0 }, { "name": "modify_oem_information", "time": 0.0 }, { "name": "modify_security_center_warnings", "time": 0.0 }, { "name": "modify_uac_prompt", "time": 0.0 }, { "name": "network_dns_blockchain", "time": 0.0 }, { "name": "network_dns_opennic", "time": 0.0 }, { "name": "network_dns_paste_site", "time": 0.0 }, { "name": "network_dns_reverse_proxy", "time": 0.0 }, { "name": "network_dns_temp_file_storage", "time": 0.0 }, { "name": "network_dns_temp_urldns", "time": 0.0 }, { "name": "network_dns_url_shortener", "time": 0.002 }, { "name": "network_dns_doh_tls", "time": 0.0 }, { "name": "suspicious_tld", "time": 0.002 }, { "name": "network_tor_service", "time": 0.0 }, { "name": "office_code_page", "time": 0.0 }, { "name": "office_addinloading", "time": 0.0 }, { "name": "office_perfkey", "time": 0.0 }, { "name": "office_macro", "time": 0.0 }, { "name": "changes_trust_center_settings", "time": 0.0 }, { "name": "disables_vba_trust_access", "time": 0.0 }, { "name": "office_macro_autoexecution", "time": 0.0 }, { "name": "office_macro_ioc", "time": 0.0 }, { "name": "office_macro_malicious_prediction", "time": 0.0 }, { "name": "office_macro_suspicious", "time": 0.0 }, { "name": "rtf_aslr_bypass", "time": 0.0 }, { "name": "rtf_anomaly_characterset", "time": 0.0 }, { "name": "rtf_anomaly_version", "time": 0.0 }, { "name": "rtf_embedded_content", "time": 0.0 }, { "name": "rtf_embedded_office_file", "time": 0.0 }, { "name": "rtf_exploit_static", "time": 0.0 }, { "name": "office_security", "time": 0.0 }, { "name": "accesses_office_username", "time": 0.0 }, { "name": "office_anomalous_feature", "time": 0.0 }, { "name": "office_dde_command", "time": 0.0 }, { "name": "packer_armadillo_mutex", "time": 0.0 }, { "name": "packer_armadillo_regkey", "time": 0.0 }, { "name": "persistence_ads", "time": 0.0 }, { "name": "persistence_safeboot", "time": 0.0 }, { "name": "persistence_ifeo", "time": 0.0 }, { "name": "persistence_silent_process_exit", "time": 0.0 }, { "name": "persistence_rdp_registry", "time": 0.0 }, { "name": "persistence_rdp_shadowing", "time": 0.0 }, { "name": "persistence_service", "time": 0.0 }, { "name": "persistence_shim_database", "time": 0.0 }, { "name": "powershell_scriptblock_logging", "time": 0.0 }, { "name": "powershell_command_suspicious", "time": 0.0 }, { "name": "powershell_history_save_mod", "time": 0.0 }, { "name": "powershell_renamed", "time": 0.0 }, { "name": "powershell_reversed", "time": 0.0 }, { "name": "powershell_variable_obfuscation", "time": 0.0 }, { "name": "prevents_safeboot", "time": 0.0 }, { "name": "cmdline_process_discovery", "time": 0.0 }, { "name": "ransomware_extensions_generic", "time": 0.0 }, { "name": "ransomware_extensions_known", "time": 0.002 }, { "name": "ransomware_files", "time": 0.003 }, { "name": "ransomware_recyclebin", "time": 0.0 }, { "name": "ransomware_revil_regkey", "time": 0.0 }, { "name": "reads_password_database", "time": 0.0 }, { "name": "recon_fingerprint", "time": 0.002 }, { "name": "rdptcp_key", "time": 0.0 }, { "name": "uses_rdp_clip", "time": 0.0 }, { "name": "uses_remote_desktop_session", "time": 0.0 }, { "name": "removes_networking_icon", "time": 0.0 }, { "name": "removes_pinned_programs", "time": 0.0 }, { "name": "removes_security_maintenance_icon", "time": 0.0 }, { "name": "removes_startmenu_defaults", "time": 0.0 }, { "name": "removes_username_startmenu", "time": 0.0 }, { "name": "sniffer_winpcap", "time": 0.0 }, { "name": "spreading_autoruninf", "time": 0.0 }, { "name": "stealth_hidden_extension", "time": 0.0 }, { "name": "stealth_hiddenreg", "time": 0.0 }, { "name": "stealth_hide_notifications", "time": 0.0 }, { "name": "stealth_webhistory", "time": 0.0 }, { "name": "sysinternals_psexec", "time": 0.0 }, { "name": "sysinternals_tools", "time": 0.0 }, { "name": "language_check_registry", "time": 0.0 }, { "name": "tampers_etw", "time": 0.0 }, { "name": "lsa_tampering", "time": 0.0 }, { "name": "tampers_powershell_logging", "time": 0.0 }, { "name": "territorial_disputes_sigs", "time": 0.051 }, { "name": "uses_adfind", "time": 0.0 }, { "name": "uses_ms_protocol", "time": 0.0 }, { "name": "owa_web_shell_files", "time": 0.0 }, { "name": "web_shell_files", "time": 0.0 }, { "name": "web_shell_processes", "time": 0.0 }, { "name": "dotnet_csc_build", "time": 0.0 }, { "name": "mavinject_lolbin", "time": 0.0 }, { "name": "multiple_explorer_instances", "time": 0.0 }, { "name": "script_tool_executed", "time": 0.0 }, { "name": "suspicious_certutil_use", "time": 0.0 }, { "name": "suspicious_command_tools", "time": 0.007 }, { "name": "suspicious_mpcmdrun_use", "time": 0.0 }, { "name": "suspicious_ping_use", "time": 0.0 }, { "name": "uses_powershell_copyitem", "time": 0.0 }, { "name": "uses_windows_utilities", "time": 0.008 }, { "name": "uses_windows_utilities_appcmd", "time": 0.0 }, { "name": "uses_windows_utilities_csvde_ldifde", "time": 0.0 }, { "name": "uses_windows_utilities_cipher", "time": 0.0 }, { "name": "uses_windows_utilities_clickonce", "time": 0.0 }, { "name": "uses_windows_utilities_curl", "time": 0.0 }, { "name": "uses_windows_utilities_dsquery", "time": 0.0 }, { "name": "uses_windows_utilities_esentutl", "time": 0.0 }, { "name": "uses_windows_utilities_finger", "time": 0.0 }, { "name": "uses_windows_utilities_mode", "time": 0.0 }, { "name": "uses_windows_utilities_ntdsutil", "time": 0.0 }, { "name": "uses_windows_utilities_nltest", "time": 0.0 }, { "name": "uses_windows_utilities_setx", "time": 0.0 }, { "name": "uses_windows_utilities_xcopy", "time": 0.0 }, { "name": "wmic_command_suspicious", "time": 0.0 }, { "name": "scrcons_wmi_script_consumer", "time": 0.0 } ], "reporting": [ { "name": "BinGraph", "time": 0.0 } ] }, "CAPE": { "payloads": [], "configs": [] }, "info": { "version": "2.5", "started": "2026-05-28 19:34:07", "ended": "2026-05-28 19:35:33", "duration": 86, "id": 23, "category": "url", "custom": "", "machine": { "id": 19, "status": "stopping", "name": "cuckoo1", "label": "cuckoo1", "platform": "windows", "manager": "KVM", "started_on": "2026-05-28 19:34:07", "shutdown_on": "2026-05-28 19:35:32" }, "package": "edge", "timeout": false, "tlp": null, "parent_sample": null, "options": { "interactive": "1", "nohuman": "yes", "vnc_port": "5910" }, "source_url": null, "route": "none", "user_id": 1, "CAPE_current_commit": "e261551257b77d1ae36b689efcf9b3d0af4476c2" }, "behavior": { "processes": [ { "process_id": 4692, "process_name": "explorer.exe", "parent_id": 4636, "module_path": "C:\\Windows\\explorer.exe", "first_seen": "2026-05-28 23:34:15,365", "calls": [ { "timestamp": "2026-05-28 23:34:18,834", "thread_id": "4696", "caller": "0x7ff62762c161", "parentcaller": "0x7ff6276b3e46", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002848" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 0 }, { "timestamp": "2026-05-28 23:34:18,834", "thread_id": "4696", "caller": "0x7ff62762c161", "parentcaller": "0x7ff6276b3e46", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029dc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-05-28 23:34:18,834", "thread_id": "4696", "caller": "0x7ff62762c161", "parentcaller": "0x7ff6276b3e46", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "user32" }, { "name": "BaseAddress", "value": "0x7ffbc77b0000" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-05-28 23:34:18,834", "thread_id": "4696", "caller": "0x7ff62762c161", "parentcaller": "0x7ff6276b3e46", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029e8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-05-28 23:34:18,834", "thread_id": "5044", "caller": "0x7ffbaf96d59f", "parentcaller": "0x7ffbaf9ac80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000029f8" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 4 }, { "timestamp": "2026-05-28 23:34:18,849", "thread_id": "5044", "caller": "0x7ffbaf96e842", "parentcaller": "0x7ffbaf96d62c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a18" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-05-28 23:34:18,849", "thread_id": "7540", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc703ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002994" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 6 }, { "timestamp": "2026-05-28 23:34:18,849", "thread_id": "7540", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc71f6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000284c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 7 }, { "timestamp": "2026-05-28 23:34:18,849", "thread_id": "4824", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc728224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 8 }, { "timestamp": "2026-05-28 23:34:19,459", "thread_id": "5824", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc703ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a0c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-05-28 23:34:19,459", "thread_id": "5824", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc728224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 10 }, { "timestamp": "2026-05-28 23:34:19,474", "thread_id": "4824", "caller": "0x7ff6276b8fba", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-05-28 23:34:19,474", "thread_id": "4824", "caller": "0x7ff6276b8fba", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239" }, { "name": "ClsContext", "value": "0x00000404", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "6D5140C1-7436-11CE-8034-00AA006009FA" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-05-28 23:34:19,537", "thread_id": "5824", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc728224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-05-28 23:34:19,537", "thread_id": "4864", "caller": "0x7ff62761f2e2", "parentcaller": "0x7ff62761f1d3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-05-28 23:34:19,537", "thread_id": "4864", "caller": "0x7ff62761f2e2", "parentcaller": "0x7ff62761f1d3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239" }, { "name": "ClsContext", "value": "0x00000404", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "6D5140C1-7436-11CE-8034-00AA006009FA" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-05-28 23:34:19,552", "thread_id": "5824", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc71f6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a08" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-05-28 23:34:19,552", "thread_id": "5044", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f198000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-05-28 23:34:19,552", "thread_id": "4824", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000298c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x0288f540" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-05-28 23:34:19,552", "thread_id": "4824", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f19a000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-05-28 23:34:19,599", "thread_id": "4828", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc728224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-05-28 23:34:19,599", "thread_id": "5044", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc728224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-05-28 23:34:19,599", "thread_id": "5044", "caller": "0x7ffbc649b8ed", "parentcaller": "0x7ffbc5c35341", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x000029fc", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffbc5c353d0" }, { "name": "Parameter", "value": "0x047e8370" }, { "name": "CreationFlags", "value": "0x00000004" }, { "name": "ThreadId", "value": "888" }, { "name": "ProcessId", "value": "4692" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-05-28 23:34:19,599", "thread_id": "5044", "caller": "0x7ffbc549f430", "parentcaller": "0x7ffbc5c35379", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x000029fc" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "888" }, { "name": "ProcessId", "value": "4692" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-05-28 23:34:19,599", "thread_id": "5836", "caller": "0x7ff627679d60", "parentcaller": "0x7ff627679c74", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-05-28 23:34:19,599", "thread_id": "5044", "caller": "0x7ffbaf96d59f", "parentcaller": "0x7ffbaf9ac80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000029fc" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 25 }, { "timestamp": "2026-05-28 23:34:19,599", "thread_id": "5044", "caller": "0x7ffbaf96e842", "parentcaller": "0x7ffbaf96d62c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a48" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-05-28 23:34:19,599", "thread_id": "5044", "caller": "0x7ffbc7249794", "parentcaller": "0x7ffbc7281dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F6C29334-47DC-4397-9150-F549CF1D4861" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-05-28 23:34:19,599", "thread_id": "5044", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002984" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x07eae080" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-05-28 23:34:19,599", "thread_id": "5044", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f1ab000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-05-28 23:34:19,599", "thread_id": "5044", "caller": "0x7ffbc7249794", "parentcaller": "0x7ffbbf80b1dd", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F6C29334-47DC-4397-9150-F549CF1D4861" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 30 }, { "timestamp": "2026-05-28 23:34:19,615", "thread_id": "5044", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbc282d2de", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x048c3000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-05-28 23:34:19,615", "thread_id": "4828", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000029ac" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x02dff8e0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-05-28 23:34:19,615", "thread_id": "4864", "caller": "0x7ff6276211b7", "parentcaller": "0x7ff6276214a4", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "95B63696-18B6-4D3E-8EC2-CDB4352318EB" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "5FEFBB8E-82C3-4EC4-93A0-05C4B9FCD4CD" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-05-28 23:34:19,974", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002974" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a18" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-05-28 23:34:19,974", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a18" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 35 }, { "timestamp": "2026-05-28 23:34:19,974", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002974" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002974" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-05-28 23:34:19,974", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a50" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029fc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-05-28 23:34:19,974", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000029fc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 38 }, { "timestamp": "2026-05-28 23:34:19,974", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a50" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a50" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-05-28 23:34:19,974", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a54" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a50" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-05-28 23:34:19,974", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a50" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 41 }, { "timestamp": "2026-05-28 23:34:19,974", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a54" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a54" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-05-28 23:34:19,974", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002974" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a54" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-05-28 23:34:19,974", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a54" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 44 }, { "timestamp": "2026-05-28 23:34:19,974", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002974" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002974" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-05-28 23:34:19,974", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a18" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002974" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-05-28 23:34:19,974", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002974" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 47 }, { "timestamp": "2026-05-28 23:34:19,974", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a18" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a18" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-05-28 23:34:19,974", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a58" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a18" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-05-28 23:34:19,974", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a18" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 50 }, { "timestamp": "2026-05-28 23:34:19,974", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a58" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a58" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-05-28 23:34:19,974", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a5c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a58" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-05-28 23:34:19,974", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a58" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 53 }, { "timestamp": "2026-05-28 23:34:19,974", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a5c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a5c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-05-28 23:34:19,974", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a60" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a5c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-05-28 23:34:19,974", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a5c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 56 }, { "timestamp": "2026-05-28 23:34:19,974", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a60" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a60" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-05-28 23:34:19,974", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a64" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a60" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-05-28 23:34:19,974", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a60" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 59 }, { "timestamp": "2026-05-28 23:34:19,974", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a64" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a64" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a68" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a64" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a64" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 62 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a68" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a68" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a6c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a68" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a68" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 65 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a6c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a6c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002984" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a64" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a64" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 68 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002984" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002984" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002980" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002984" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002984" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 71 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002980" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002980" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002970" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002980" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002980" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 74 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002970" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002970" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000296c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002970" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002970" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 77 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000296c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000296c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002968" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000296c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000296c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 80 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002968" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002968" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a70" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002968" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002968" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 83 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a70" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a70" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a74" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a70" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a70" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 86 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a74" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a74" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a78" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a74" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a74" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 89 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a78" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a78" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a7c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a78" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a78" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 92 }, { "timestamp": "2026-05-28 23:34:19,990", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a7c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a7c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002964" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a7c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a7c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 95 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002964" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002964" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029ac" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000020d0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000020d0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 98 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029ac" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029ac" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a30" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a6c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a6c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 101 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a30" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a30" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a80" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a30" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a30" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 104 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a80" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a80" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f88" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a80" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a80" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 107 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f88" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f88" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002964" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f88" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001f88" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 110 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002964" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002964" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002960" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002964" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002964" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 113 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002960" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002960" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a84" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002960" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002960" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 116 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a84" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a84" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a88" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a84" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a84" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 119 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a88" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a88" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a8c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a88" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a88" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 122 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a8c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a8c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000295c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a8c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 124 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a8c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 125 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000295c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000295c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002958" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000295c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000295c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 128 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002958" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002958" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 129 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a90" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002958" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 130 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002958" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 131 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a90" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a90" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 132 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a94" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a90" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 133 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a90" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 134 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a94" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a94" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a98" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a94" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a94" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 137 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a98" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a98" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029ac" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a98" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 139 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a98" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 140 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029ac" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029ac" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 141 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002954" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029ac" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 142 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000029ac" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 143 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002954" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002954" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 144 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000020d0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002954" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 145 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002954" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 146 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000020d0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000020d0" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 147 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a9c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000020d0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 148 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000020d0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 149 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a9c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a9c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 150 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002aa0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a9c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 151 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a9c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 152 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002aa0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002aa0" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 153 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002aa4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000021f8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 154 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000021f8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 155 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 156 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 157 }, { "timestamp": "2026-05-28 23:34:20,224", "thread_id": "4944", "caller": "0x7ffbb5cc12f2", "parentcaller": "0x7ffbb5cc109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 158 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb5cbc333", "parentcaller": "0x7ffbb5cb9609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 159 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 160 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 161 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 162 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 163 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 164 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 165 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 166 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 167 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb5cbc375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 168 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 169 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 170 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 171 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 172 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 173 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 174 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 175 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 176 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 177 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 178 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 179 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb5cc12f2", "parentcaller": "0x7ffbb5cc109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 180 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb5cbc333", "parentcaller": "0x7ffbb5cb9609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 181 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 182 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 183 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 184 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 185 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 186 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 187 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 188 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 189 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb5cbc375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 190 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 191 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 192 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 193 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 194 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 195 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb5cc12f2", "parentcaller": "0x7ffbb5cc109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 196 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb5cbc333", "parentcaller": "0x7ffbb5cb9609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 197 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 198 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 199 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 200 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 201 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 202 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 203 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 204 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 205 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb5cbc375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 206 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 207 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 208 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 209 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 210 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 211 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 212 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 213 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 214 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 215 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 216 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\dlnashext" }, { "name": "DllBase", "value": "0x7ffbb9d80000" } ], "repeated": 0, "id": 217 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\dlnashext.dll" }, { "name": "BaseAddress", "value": "0x7ffbb9d80000" } ], "repeated": 0, "id": 218 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "289AF617-1CC3-42A6-926C-E6A863F0E3BA" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 219 }, { "timestamp": "2026-05-28 23:34:20,240", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 220 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\WinSxS\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.3636_none_91a19322cc8a92a3\\gdiplus" }, { "name": "DllBase", "value": "0x7ffb881f0000" } ], "repeated": 0, "id": 221 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\wpdshext" }, { "name": "DllBase", "value": "0x7ffbb4520000" } ], "repeated": 0, "id": 222 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\wpdshext.dll" }, { "name": "BaseAddress", "value": "0x7ffbb4520000" } ], "repeated": 0, "id": 223 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "35786D3C-B075-49B9-88DD-029876E11C01" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 224 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc34259d3", "parentcaller": "0x7ffbc3496922", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 225 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000634" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 226 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc348d4e4", "parentcaller": "0x7ffbc33c3285", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00b3a281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 227 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000634" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 228 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc348d4e4", "parentcaller": "0x7ffbc33c348f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00b3a281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 229 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000634" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 230 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000634" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 231 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000634" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 232 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000634" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 233 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc348d4e4", "parentcaller": "0x7ffbc33c3285", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00b3a281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 234 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000001" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 235 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc348d4e4", "parentcaller": "0x7ffbc33c348f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00b3a281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 236 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000634" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 237 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000634" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 238 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 239 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "289AF617-1CC3-42A6-926C-E6A863F0E3BA" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 240 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 241 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "35786D3C-B075-49B9-88DD-029876E11C01" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 242 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 243 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 244 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb5cc12f2", "parentcaller": "0x7ffbb5cc109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 245 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb5cbc333", "parentcaller": "0x7ffbb5cb9609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 246 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 247 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 248 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 249 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 250 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 251 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 252 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 253 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 254 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb5cbc375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 255 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 256 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 257 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 258 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 259 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 260 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb5cc12f2", "parentcaller": "0x7ffbb5cc109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 261 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb5cbc333", "parentcaller": "0x7ffbb5cb9609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 262 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 263 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 264 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 265 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 266 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 267 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 268 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 269 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 270 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb5cbc375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 271 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 272 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 273 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 274 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 275 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 276 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 277 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 278 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 279 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 280 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 281 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 282 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb5cc12f2", "parentcaller": "0x7ffbb5cc109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 283 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb5cbc333", "parentcaller": "0x7ffbb5cb9609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 284 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 285 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 286 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 287 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 288 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 289 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 290 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 291 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 292 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb5cbc375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 293 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 294 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 295 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 296 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 297 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 298 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb5cc12f2", "parentcaller": "0x7ffbb5cc109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 299 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb5cbc333", "parentcaller": "0x7ffbb5cb9609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 300 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 301 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 302 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 303 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 304 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 305 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 306 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 307 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 308 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb5cbc375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 309 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 310 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 311 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 312 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 313 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 314 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 315 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 316 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 317 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 318 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 319 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 320 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb5cc12f2", "parentcaller": "0x7ffbb5cc109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 321 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb5cbc333", "parentcaller": "0x7ffbb5cb9609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 322 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 323 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 324 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 325 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 326 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 327 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 328 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 329 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 330 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb5cbc375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 331 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 332 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 333 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 334 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002aa4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002aa4" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 335 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002950" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002aa4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 336 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002aa4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 337 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002950" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002950" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 338 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f68" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002950" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 339 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002950" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 340 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f68" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f68" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 341 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000294c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f68" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 342 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001f68" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 343 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000294c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000294c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 344 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002948" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f68" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 345 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001f68" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 346 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 347 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 348 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb5cc12f2", "parentcaller": "0x7ffbb5cc109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 349 }, { "timestamp": "2026-05-28 23:34:20,256", "thread_id": "4944", "caller": "0x7ffbb5cbc333", "parentcaller": "0x7ffbb5cb9609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 350 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 351 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 352 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 353 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 354 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 355 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 356 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 357 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 358 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb5cbc375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 359 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 360 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 361 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 362 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 363 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 364 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 365 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 366 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 367 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 368 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 369 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 370 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb5cc12f2", "parentcaller": "0x7ffbb5cc109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 371 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb5cbc333", "parentcaller": "0x7ffbb5cb9609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 372 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 373 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 374 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 375 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 376 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 377 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 378 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 379 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 380 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb5cbc375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 381 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 382 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 383 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 384 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 385 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 386 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb5cc12f2", "parentcaller": "0x7ffbb5cc109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 387 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb5cbc333", "parentcaller": "0x7ffbb5cb9609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 388 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 389 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 390 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 391 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 392 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 393 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 394 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 395 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 396 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb5cbc375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 397 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 398 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 399 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 400 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 401 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 402 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 403 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 404 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 405 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 406 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 407 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "289AF617-1CC3-42A6-926C-E6A863F0E3BA" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 408 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 409 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "35786D3C-B075-49B9-88DD-029876E11C01" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 410 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 411 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "289AF617-1CC3-42A6-926C-E6A863F0E3BA" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 412 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 413 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "35786D3C-B075-49B9-88DD-029876E11C01" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 414 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 415 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 416 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb5cc12f2", "parentcaller": "0x7ffbb5cc109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 417 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb5cbc333", "parentcaller": "0x7ffbb5cb9609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 418 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 419 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 420 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 421 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 422 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 423 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 424 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 425 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 426 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb5cbc375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 427 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 428 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 429 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 430 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 431 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 432 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb5cc12f2", "parentcaller": "0x7ffbb5cc109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 433 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb5cbc333", "parentcaller": "0x7ffbb5cb9609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 434 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 435 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 436 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 437 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 438 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 439 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 440 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 441 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 442 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb5cbc375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 443 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 444 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 445 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 446 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 447 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 448 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 449 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 450 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 451 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 452 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 453 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 454 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb5cc12f2", "parentcaller": "0x7ffbb5cc109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 455 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb5cbc333", "parentcaller": "0x7ffbb5cb9609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 456 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 457 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 458 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 459 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 460 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 461 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 462 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 463 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 464 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb5cbc375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 465 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 466 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 467 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 468 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 469 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 470 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb5cc12f2", "parentcaller": "0x7ffbb5cc109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 471 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb5cbc333", "parentcaller": "0x7ffbb5cb9609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 472 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 473 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 474 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 475 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 476 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 477 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 478 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 479 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 480 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb5cbc375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 481 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 482 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 483 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 484 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 485 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 486 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 487 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 488 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 489 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 490 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 491 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 492 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb5cc12f2", "parentcaller": "0x7ffbb5cc109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 493 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb5cbc333", "parentcaller": "0x7ffbb5cb9609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 494 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 495 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 496 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 497 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 498 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 499 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 500 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 501 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 502 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb5cbc375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 503 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 504 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 505 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 506 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002948" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002948" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 507 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f6c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002948" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 508 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002948" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 509 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f6c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f6c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 510 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002944" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f6c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 511 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001f6c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 512 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 513 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 514 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb5cc12f2", "parentcaller": "0x7ffbb5cc109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 515 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb5cbc333", "parentcaller": "0x7ffbb5cb9609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 516 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 517 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 518 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 519 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 520 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 521 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 522 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 523 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 524 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb5cbc375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 525 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 526 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 527 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 528 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 529 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 530 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 531 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 532 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 533 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 534 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 535 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 536 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb5cc12f2", "parentcaller": "0x7ffbb5cc109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 537 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb5cbc333", "parentcaller": "0x7ffbb5cb9609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 538 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 539 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 540 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 541 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 542 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 543 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 544 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 545 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 546 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb5cbc375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 547 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 548 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 549 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 550 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 551 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 552 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb5cc12f2", "parentcaller": "0x7ffbb5cc109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 553 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb5cbc333", "parentcaller": "0x7ffbb5cb9609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 554 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 555 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 556 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 557 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 558 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 559 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 560 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 561 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 562 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb5cbc375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 563 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 564 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 565 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 566 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 567 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 568 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 569 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 570 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 571 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 572 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 573 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "289AF617-1CC3-42A6-926C-E6A863F0E3BA" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 574 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 575 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "35786D3C-B075-49B9-88DD-029876E11C01" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 576 }, { "timestamp": "2026-05-28 23:34:20,271", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 577 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "289AF617-1CC3-42A6-926C-E6A863F0E3BA" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 578 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 579 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "35786D3C-B075-49B9-88DD-029876E11C01" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 580 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 581 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 582 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb5cc12f2", "parentcaller": "0x7ffbb5cc109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 583 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb5cbc333", "parentcaller": "0x7ffbb5cb9609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 584 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 585 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 586 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 587 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 588 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 589 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 590 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 591 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 592 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb5cbc375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 593 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 594 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 595 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 596 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 597 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 598 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb5cc12f2", "parentcaller": "0x7ffbb5cc109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 599 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb5cbc333", "parentcaller": "0x7ffbb5cb9609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 600 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 601 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 602 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 603 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 604 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 605 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 606 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 607 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 608 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb5cbc375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 609 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 610 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 611 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 612 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 613 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 614 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 615 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 616 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 617 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 618 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 619 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 620 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb5cc12f2", "parentcaller": "0x7ffbb5cc109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 621 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb5cbc333", "parentcaller": "0x7ffbb5cb9609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 622 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 623 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 624 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 625 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 626 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 627 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 628 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 629 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 630 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb5cbc375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 631 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 632 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 633 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 634 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 635 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 636 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb5cc12f2", "parentcaller": "0x7ffbb5cc109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 637 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb5cbc333", "parentcaller": "0x7ffbb5cb9609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 638 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 639 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 640 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 641 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 642 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 643 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 644 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 645 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 646 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb5cbc375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 647 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 648 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 649 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 650 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 651 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 652 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 653 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 654 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 655 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 656 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 657 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 658 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb5cc12f2", "parentcaller": "0x7ffbb5cc109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 659 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb5cbc333", "parentcaller": "0x7ffbb5cb9609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 660 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 661 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 662 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 663 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 664 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 665 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 666 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 667 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 668 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb5cbc375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 669 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 670 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 671 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 672 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002944" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002944" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 673 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002aa0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002944" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 674 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002944" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 675 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 676 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 677 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb5cc12f2", "parentcaller": "0x7ffbb5cc109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 678 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb5cbc333", "parentcaller": "0x7ffbb5cb9609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 679 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 680 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 681 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 682 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 683 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 684 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 685 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 686 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 687 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb5cbc375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 688 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 689 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 690 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 691 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 692 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 693 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 694 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 695 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 696 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 697 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 698 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 699 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb5cc12f2", "parentcaller": "0x7ffbb5cc109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 700 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb5cbc333", "parentcaller": "0x7ffbb5cb9609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 701 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 702 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 703 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 704 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 705 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 706 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 707 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 708 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 709 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb5cbc375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 710 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 711 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 712 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 713 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 714 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 715 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb5cc12f2", "parentcaller": "0x7ffbb5cc109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 716 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb5cbc333", "parentcaller": "0x7ffbb5cb9609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 717 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 718 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 719 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 720 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 721 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 722 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 723 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 724 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 725 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb5cbc375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 726 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 727 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 728 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 729 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 730 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 731 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 732 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 733 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 734 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 735 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 736 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "289AF617-1CC3-42A6-926C-E6A863F0E3BA" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 737 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 738 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "35786D3C-B075-49B9-88DD-029876E11C01" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 739 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 740 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "289AF617-1CC3-42A6-926C-E6A863F0E3BA" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 741 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 742 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "35786D3C-B075-49B9-88DD-029876E11C01" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 743 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 744 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 745 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb5cc12f2", "parentcaller": "0x7ffbb5cc109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 746 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb5cbc333", "parentcaller": "0x7ffbb5cb9609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 747 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 748 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 749 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 750 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 751 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 752 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 753 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 754 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 755 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb5cbc375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 756 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 757 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 758 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 759 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 760 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 761 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb5cc12f2", "parentcaller": "0x7ffbb5cc109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 762 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb5cbc333", "parentcaller": "0x7ffbb5cb9609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 763 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 764 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 765 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 766 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 767 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 768 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 769 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 770 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 771 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb5cbc375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 772 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 773 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 774 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 775 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 776 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 777 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 778 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 779 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 780 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 781 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 782 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 783 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb5cc12f2", "parentcaller": "0x7ffbb5cc109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 784 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb5cbc333", "parentcaller": "0x7ffbb5cb9609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 785 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 786 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 787 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 788 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 789 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 790 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 791 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 792 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 793 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb5cbc375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 794 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 795 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 796 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 797 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 798 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbc3425882", "parentcaller": "0x7ffbc3424474", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "04731B67-D933-450A-90E6-4ACD2E9408FE" }, { "name": "ClsContext", "value": "0x00000401", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 799 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb5cc12f2", "parentcaller": "0x7ffbb5cc109a", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "DB6EFB73-5153-43B7-8078-C6FFC4C0238C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "EA69859A-DB5B-4C4A-8A8F-AE9759027534" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 800 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb5cbc333", "parentcaller": "0x7ffbb5cb9609", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 801 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 802 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 803 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 804 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 805 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 806 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 807 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb9b86111", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "8DE9C74C-605A-4ACD-BEE3-2B222AA2D23D" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 808 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b85ed6", "parentcaller": "0x7ffbb9b84fe8", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "52F15C89-5A17-48E1-BBCD-46A3F89C7CC2" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 809 }, { "timestamp": "2026-05-28 23:34:20,287", "thread_id": "4944", "caller": "0x7ffbb9b860d1", "parentcaller": "0x7ffbb5cbc375", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "116F8D13-101E-4FA5-84D4-FF8279381935" }, { "name": "ClsContext", "value": "0x00000415", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "0FC988D4-C935-4B97-A973-46282EA175C8" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 810 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 5, "id": 811 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002aa0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002aa0" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 812 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002184" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002aa0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 813 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002aa0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 814 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002184" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002184" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 815 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002940" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002184" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 816 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002184" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 817 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002940" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002940" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 818 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002938" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002940" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 819 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002940" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 820 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002938" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002938" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 821 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000294c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002938" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 822 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002938" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 823 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000294c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000294c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 824 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002aa8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000294c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 825 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000294c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 826 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002aa8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002aa8" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 827 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002aac" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002aa8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 828 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002aa8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 829 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002aac" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002aac" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 830 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ab0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002aac" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 831 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002aac" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 832 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 31, "id": 833 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ab0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ab0" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 834 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000293c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ab0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 835 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002ab0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 836 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 31, "id": 837 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000293c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000293c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 838 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002934" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000293c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 839 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000293c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 840 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002934" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002934" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 841 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002930" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002934" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 842 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002934" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 843 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002930" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002930" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 844 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000292c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002930" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 845 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002930" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 846 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 31, "id": 847 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000292c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000292c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 848 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ab4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000292c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 849 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000292c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 850 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ab4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ab4" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 851 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ab8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ab4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 852 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002ab4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 853 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ab8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ab8" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 854 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002abc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ab8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 855 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002ab8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 856 }, { "timestamp": "2026-05-28 23:34:20,302", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 31, "id": 857 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002abc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002abc" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 858 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002944" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002abc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 859 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002abc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 860 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002944" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002944" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 861 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002924" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002944" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 862 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002944" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 863 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002924" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002924" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 864 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002920" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002924" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 865 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002924" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 866 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002920" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002920" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 867 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002950" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002920" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 868 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002920" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 869 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002950" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002950" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 870 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002aa4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002950" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 871 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002950" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 872 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002aa4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002aa4" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 873 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f6c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002aa4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 874 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002aa4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 875 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f6c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f6c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 876 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002948" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f6c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 877 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001f6c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 878 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 31, "id": 879 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002948" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002948" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 880 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ac0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002948" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 881 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002948" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 882 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ac0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ac0" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 883 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000291c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ac0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 884 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002ac0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 885 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000291c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000291c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 886 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002918" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000291c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 887 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000291c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 888 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002918" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002918" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 889 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002914" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002918" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 890 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002918" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 891 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 31, "id": 892 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002914" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002914" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 893 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002910" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002914" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 894 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002914" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 895 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002910" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002910" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 896 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ab8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002910" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 897 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002910" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 898 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ab8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ab8" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 899 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000093c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ab8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 900 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002ab8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 901 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000093c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000093c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 902 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ab4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000093c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 903 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000093c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 904 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ab4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ab4" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 905 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000290c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ab4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 906 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002ab4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 907 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 31, "id": 908 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000290c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000290c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 909 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000934" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000290c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 910 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000290c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 911 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000934" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000934" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 912 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f68" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000934" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 913 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000934" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 914 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f68" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f68" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 915 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000292c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f68" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 916 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001f68" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 917 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000292c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000292c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 918 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002930" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000292c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 919 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000292c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 920 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002930" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002930" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 921 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002908" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000018fc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 922 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000018fc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 923 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002908" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002908" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 924 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002934" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000018fc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 925 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000018fc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 926 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002934" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002934" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 927 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000634" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002934" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 928 }, { "timestamp": "2026-05-28 23:34:20,318", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002934" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 929 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000634" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000634" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 930 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000293c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000018fc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 931 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000018fc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 932 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 31, "id": 933 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000293c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000293c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 934 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001904" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000293c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 935 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000293c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 936 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 31, "id": 937 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001904" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001904" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 938 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029ac" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001904" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 939 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001904" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 940 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029ac" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029ac" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 941 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ab0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029ac" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 942 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000029ac" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 943 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ab0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ab0" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 944 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002904" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ab0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 945 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002ab0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 946 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002904" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002904" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 947 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002aac" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002904" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 948 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002904" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 949 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002aac" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002aac" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 950 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002900" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002aac" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 951 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002aac" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 952 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002900" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002900" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 953 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002908" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002900" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 954 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002900" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 955 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002908" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002908" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 956 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002930" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002908" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 957 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002908" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 958 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002930" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002930" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 959 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002934" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002930" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 960 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002930" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 961 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 31, "id": 962 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002934" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002934" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 963 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000634" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002934" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 964 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002934" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 965 }, { "timestamp": "2026-05-28 23:34:20,334", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 31, "id": 966 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000634" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000634" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 967 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002aa8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000634" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 968 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000634" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 969 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002aa8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002aa8" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 970 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000294c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002aa8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 971 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002aa8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 972 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000294c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000294c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 973 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002938" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000294c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 974 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000294c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 975 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 31, "id": 976 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002938" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002938" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 977 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a98" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002938" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 978 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002938" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 979 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a98" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a98" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 980 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000292c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a98" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 981 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a98" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 982 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000292c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000292c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 983 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ab0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000292c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 984 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000292c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 985 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ab0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ab0" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 986 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029ac" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ab0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 987 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002ab0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 988 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029ac" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029ac" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 989 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002940" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029ac" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 990 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000029ac" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 991 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002940" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002940" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 992 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002900" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002aa0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 993 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002aa0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 994 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 31, "id": 995 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002900" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002900" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 996 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028fc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002900" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 997 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002900" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 998 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028fc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028fc" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 999 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f68" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028fc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1000 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000028fc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1001 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f68" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f68" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1002 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028f8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ab0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1003 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002ab0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1004 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028f8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028f8" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1005 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a94" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028f8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1006 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000028f8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1007 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a94" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a94" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1008 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a90" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a94" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1009 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a94" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1010 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a90" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a90" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1011 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002958" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a90" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1012 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a90" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1013 }, { "timestamp": "2026-05-28 23:34:20,349", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 31, "id": 1014 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002958" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002958" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1015 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002184" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002958" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1016 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002958" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1017 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002184" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002184" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1018 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000295c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002184" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1019 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002184" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1020 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000295c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000295c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1021 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000934" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000295c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1022 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000295c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1023 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000934" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000934" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1024 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002940" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000934" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1025 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000934" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1026 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002940" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002940" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1027 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000290c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002940" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1028 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002940" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1029 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000290c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000290c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1030 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029ac" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000290c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1031 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000290c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1032 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029ac" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029ac" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1033 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028f4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029ac" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1034 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000029ac" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1035 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028f4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028f4" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1036 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ab4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029ac" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1037 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000029ac" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1038 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ab4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ab4" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1039 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f68" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029ac" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1040 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000029ac" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1041 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f68" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f68" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1042 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a90" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f68" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1043 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001f68" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1044 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a90" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a90" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1045 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028fc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002aa0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1046 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002aa0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1047 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028fc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028fc" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1048 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002940" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a90" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1049 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a90" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1050 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002940" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002940" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1051 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a8c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002940" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1052 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002940" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1053 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a8c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a8c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1054 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028f0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a8c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1055 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a8c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1056 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028f0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028f0" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1057 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002900" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028f0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1058 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000028f0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1059 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002900" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002900" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1060 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ab4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002900" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1061 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002900" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1062 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ab4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ab4" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1063 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a88" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ab4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1064 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002ab4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1065 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a88" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a88" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1066 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028f4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a88" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1067 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a88" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1068 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028f4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028f4" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1069 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000093c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028f4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1070 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000028f4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1071 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000093c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000093c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1072 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a8c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000093c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1073 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000093c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1074 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a8c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a8c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1075 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028ec" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a8c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1076 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a8c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1077 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028ec" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028ec" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1078 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ab4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028ec" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1079 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000028ec" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1080 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ab4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ab4" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1081 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028fc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ab4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1082 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002ab4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1083 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028fc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028fc" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1084 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ab8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028fc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1085 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000028fc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1086 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ab8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ab8" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1087 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000093c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ab8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1088 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002ab8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1089 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000093c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000093c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1090 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028ec" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002914" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1091 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002914" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1092 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028ec" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028ec" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1093 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028e8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028ec" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1094 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000028ec" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1095 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028e8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028e8" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1096 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002910" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028ec" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1097 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000028ec" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1098 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 31, "id": 1099 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002910" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002910" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1100 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028e4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ab8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1101 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002ab8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1102 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028e4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028e4" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1103 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028e0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028e4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1104 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000028e4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1105 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028e0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028e0" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1106 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028e8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028e0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1107 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000028e0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1108 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028e8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028e8" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1109 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002aa0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028e8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1110 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000028e8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1111 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002aa0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002aa0" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1112 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002928" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002aa0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1113 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002aa0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1114 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002928" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002928" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1115 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028dc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002928" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1116 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002928" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1117 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 31, "id": 1118 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028dc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028dc" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1119 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002910" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028dc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1120 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000028dc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1121 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002910" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002910" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1122 }, { "timestamp": "2026-05-28 23:34:20,365", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002910" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1123 }, { "timestamp": "2026-05-28 23:34:20,381", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002aa0" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1124 }, { "timestamp": "2026-05-28 23:34:20,381", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000028e0" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1125 }, { "timestamp": "2026-05-28 23:34:20,381", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002ab8" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1126 }, { "timestamp": "2026-05-28 23:34:20,381", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002ab4" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1127 }, { "timestamp": "2026-05-28 23:34:20,381", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000028f4" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1128 }, { "timestamp": "2026-05-28 23:34:20,381", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002900" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1129 }, { "timestamp": "2026-05-28 23:34:20,381", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002940" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1130 }, { "timestamp": "2026-05-28 23:34:20,381", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f68" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1131 }, { "timestamp": "2026-05-28 23:34:20,381", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000290c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1132 }, { "timestamp": "2026-05-28 23:34:20,381", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000295c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Burn" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1133 }, { "timestamp": "2026-05-28 23:34:20,381", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002958" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Burn" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1134 }, { "timestamp": "2026-05-28 23:34:20,381", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000028f8" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1135 }, { "timestamp": "2026-05-28 23:34:20,381", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000292c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1136 }, { "timestamp": "2026-05-28 23:34:20,381", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002938" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1137 }, { "timestamp": "2026-05-28 23:34:20,381", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002aa8" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1138 }, { "timestamp": "2026-05-28 23:34:20,381", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028ec" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002934" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1139 }, { "timestamp": "2026-05-28 23:34:20,381", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002934" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1140 }, { "timestamp": "2026-05-28 23:34:20,381", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000028ec" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028ec" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1141 }, { "timestamp": "2026-05-28 23:34:20,381", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002914" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028ec" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1142 }, { "timestamp": "2026-05-28 23:34:20,381", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000028ec" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1143 }, { "timestamp": "2026-05-28 23:34:20,381", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002914" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002914" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1144 }, { "timestamp": "2026-05-28 23:34:20,381", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002914" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1145 }, { "timestamp": "2026-05-28 23:34:20,381", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000634" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1146 }, { "timestamp": "2026-05-28 23:34:20,381", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002918" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002908" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1147 }, { "timestamp": "2026-05-28 23:34:20,381", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002908" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1148 }, { "timestamp": "2026-05-28 23:34:20,381", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002918" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002918" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1149 }, { "timestamp": "2026-05-28 23:34:20,381", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002918" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1150 }, { "timestamp": "2026-05-28 23:34:20,381", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002aac" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1151 }, { "timestamp": "2026-05-28 23:34:20,381", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000291c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001904" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1152 }, { "timestamp": "2026-05-28 23:34:20,381", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001904" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1153 }, { "timestamp": "2026-05-28 23:34:20,381", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000291c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000291c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1154 }, { "timestamp": "2026-05-28 23:34:20,490", "thread_id": "4828", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000028d8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x02dff8e0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1155 }, { "timestamp": "2026-05-28 23:34:20,490", "thread_id": "4828", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f1bc000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1156 }, { "timestamp": "2026-05-28 23:34:20,490", "thread_id": "5244", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc71f6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002904" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1157 }, { "timestamp": "2026-05-28 23:34:20,506", "thread_id": "4828", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000028cc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x02dff8e0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1158 }, { "timestamp": "2026-05-28 23:34:20,521", "thread_id": "5044", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000293c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x07eae080" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1159 }, { "timestamp": "2026-05-28 23:34:20,521", "thread_id": "5044", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001f6c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x07eae080" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1160 }, { "timestamp": "2026-05-28 23:34:20,521", "thread_id": "5140", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000291c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x0a31f480" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1161 }, { "timestamp": "2026-05-28 23:34:21,365", "thread_id": "5816", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002960" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1162 }, { "timestamp": "2026-05-28 23:34:21,365", "thread_id": "5816", "caller": "0x7ffbc5433d8e", "parentcaller": "0x7ffbc5433354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a84" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00002000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1163 }, { "timestamp": "2026-05-28 23:34:21,365", "thread_id": "5816", "caller": "0x7ffbc5433395", "parentcaller": "0x7ffbc5433f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "RegionSize", "value": "0x00002000" } ], "repeated": 0, "id": 1164 }, { "timestamp": "2026-05-28 23:34:21,365", "thread_id": "5816", "caller": "0x7ffbc6490571", "parentcaller": "0x7ffbc6490427", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a84" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\apppatch\\sysmain.sdb" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1165 }, { "timestamp": "2026-05-28 23:34:21,365", "thread_id": "5816", "caller": "0x7ffbc64902b3", "parentcaller": "0x7ffbc649003b", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000291c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7180000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x003e3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1166 }, { "timestamp": "2026-05-28 23:34:21,365", "thread_id": "5816", "caller": "0x7ffbc6491830", "parentcaller": "0x7ffbc6491772", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7180000" }, { "name": "RegionSize", "value": "0x003e3000" } ], "repeated": 0, "id": 1167 }, { "timestamp": "2026-05-28 23:34:21,381", "thread_id": "4824", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f1cd000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1168 }, { "timestamp": "2026-05-28 23:34:21,381", "thread_id": "4824", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f1d0000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1169 }, { "timestamp": "2026-05-28 23:34:21,381", "thread_id": "4824", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f1d3000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1170 }, { "timestamp": "2026-05-28 23:34:21,381", "thread_id": "4824", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f1d8000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1171 }, { "timestamp": "2026-05-28 23:34:21,381", "thread_id": "4824", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f1dd000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1172 }, { "timestamp": "2026-05-28 23:34:21,381", "thread_id": "4824", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f1e2000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1173 }, { "timestamp": "2026-05-28 23:34:21,381", "thread_id": "5244", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f1e7000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1174 }, { "timestamp": "2026-05-28 23:34:21,381", "thread_id": "4824", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f1ea000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1175 }, { "timestamp": "2026-05-28 23:34:21,381", "thread_id": "4824", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f1ef000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1176 }, { "timestamp": "2026-05-28 23:34:21,381", "thread_id": "4824", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f1f2000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1177 }, { "timestamp": "2026-05-28 23:34:21,381", "thread_id": "4828", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f1fb000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1178 }, { "timestamp": "2026-05-28 23:34:21,381", "thread_id": "4828", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f200000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1179 }, { "timestamp": "2026-05-28 23:34:21,396", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f205000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1180 }, { "timestamp": "2026-05-28 23:34:21,396", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f207000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1181 }, { "timestamp": "2026-05-28 23:34:21,396", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f20a000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1182 }, { "timestamp": "2026-05-28 23:34:21,396", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f20c000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1183 }, { "timestamp": "2026-05-28 23:34:21,396", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f20f000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1184 }, { "timestamp": "2026-05-28 23:34:21,396", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f212000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1185 }, { "timestamp": "2026-05-28 23:34:21,412", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f214000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1186 }, { "timestamp": "2026-05-28 23:34:21,412", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f217000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1187 }, { "timestamp": "2026-05-28 23:34:21,412", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f21c000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1188 }, { "timestamp": "2026-05-28 23:34:21,412", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f21f000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1189 }, { "timestamp": "2026-05-28 23:34:21,412", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f220000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1190 }, { "timestamp": "2026-05-28 23:34:21,412", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f221000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1191 }, { "timestamp": "2026-05-28 23:34:21,427", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f226000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1192 }, { "timestamp": "2026-05-28 23:34:21,427", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f22f000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1193 }, { "timestamp": "2026-05-28 23:34:21,427", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f234000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1194 }, { "timestamp": "2026-05-28 23:34:21,427", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f237000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1195 }, { "timestamp": "2026-05-28 23:34:21,443", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f23c000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1196 }, { "timestamp": "2026-05-28 23:34:21,443", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f23f000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1197 }, { "timestamp": "2026-05-28 23:34:21,459", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f244000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1198 }, { "timestamp": "2026-05-28 23:34:21,459", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f246000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1199 }, { "timestamp": "2026-05-28 23:34:21,459", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f24f000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1200 }, { "timestamp": "2026-05-28 23:34:21,474", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f254000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1201 }, { "timestamp": "2026-05-28 23:34:21,474", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f256000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1202 }, { "timestamp": "2026-05-28 23:34:21,474", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f25b000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1203 }, { "timestamp": "2026-05-28 23:34:21,474", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f264000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1204 }, { "timestamp": "2026-05-28 23:34:21,490", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f26d000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1205 }, { "timestamp": "2026-05-28 23:34:21,490", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f272000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1206 }, { "timestamp": "2026-05-28 23:34:21,490", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f277000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1207 }, { "timestamp": "2026-05-28 23:34:21,506", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f27a000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1208 }, { "timestamp": "2026-05-28 23:34:21,506", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f283000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1209 }, { "timestamp": "2026-05-28 23:34:21,537", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f28c000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1210 }, { "timestamp": "2026-05-28 23:34:21,537", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f28f000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1211 }, { "timestamp": "2026-05-28 23:34:21,537", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f294000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1212 }, { "timestamp": "2026-05-28 23:34:21,537", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f29d000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1213 }, { "timestamp": "2026-05-28 23:34:21,552", "thread_id": "5140", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f2a6000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1214 }, { "timestamp": "2026-05-28 23:34:21,552", "thread_id": "5816", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\execmodelclient" }, { "name": "DllBase", "value": "0x7ffbb5020000" } ], "repeated": 0, "id": 1215 }, { "timestamp": "2026-05-28 23:34:21,552", "thread_id": "5816", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\execmodelclient.dll" }, { "name": "BaseAddress", "value": "0x7ffbb5020000" } ], "repeated": 0, "id": 1216 }, { "timestamp": "2026-05-28 23:34:21,552", "thread_id": "5816", "caller": "0x7ffbaf987741", "parentcaller": "0x7ffbaf988661", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "38142214-ED63-4965-9214-1BBC06E130E9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8E1BBBB9-B3D5-430D-B276-D0E7454CAAB2" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1217 }, { "timestamp": "2026-05-28 23:34:21,552", "thread_id": "5816", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc71f6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a80" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1218 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbaf988695", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ploptin" }, { "name": "DllBase", "value": "0x7ffbba650000" } ], "repeated": 0, "id": 1219 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbaf988695", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00800000" }, { "name": "FileName", "value": "ploptin.dll" }, { "name": "BaseAddress", "value": "0x7ffbba650000" } ], "repeated": 0, "id": 1220 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc544acfe", "parentcaller": "0x7ffbaf9886fd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ploptin" }, { "name": "DllBase", "value": "0x7ffbba650000" } ], "repeated": 0, "id": 1221 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc7bc0db0", "parentcaller": "0x7ffbc7b80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbba650000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1222 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a84" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1223 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc5433d8e", "parentcaller": "0x7ffbc5433354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a30" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1224 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc5433395", "parentcaller": "0x7ffbc5433f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1225 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a84" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.StartMenuExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1226 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc5433d8e", "parentcaller": "0x7ffbc5433354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a30" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1227 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc5433395", "parentcaller": "0x7ffbc5433f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1228 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002aa4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1229 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc5433d8e", "parentcaller": "0x7ffbc5433354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002950" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1230 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc5433395", "parentcaller": "0x7ffbc5433f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1231 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a84" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecHealthUI_10.0.19041.3636_neutral__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1232 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc5433d8e", "parentcaller": "0x7ffbc5433354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002950" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1233 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc5433395", "parentcaller": "0x7ffbc5433f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1234 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbaf987741", "parentcaller": "0x7ffbaf988661", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "38142214-ED63-4965-9214-1BBC06E130E9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8E1BBBB9-B3D5-430D-B276-D0E7454CAAB2" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1235 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbaf988695", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ploptin" }, { "name": "DllBase", "value": "0x7ffbba650000" } ], "repeated": 0, "id": 1236 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbaf988695", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00800000" }, { "name": "FileName", "value": "ploptin.dll" }, { "name": "BaseAddress", "value": "0x7ffbba650000" } ], "repeated": 0, "id": 1237 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc544acfe", "parentcaller": "0x7ffbaf9886fd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ploptin" }, { "name": "DllBase", "value": "0x7ffbba650000" } ], "repeated": 0, "id": 1238 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc7bc0db0", "parentcaller": "0x7ffbc7b80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbba650000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1239 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002950" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\windows.immersivecontrolpanel_10.0.2.1000_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1240 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc5433d8e", "parentcaller": "0x7ffbc5433354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002aa4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1241 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc5433395", "parentcaller": "0x7ffbc5433f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1242 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc6490571", "parentcaller": "0x7ffbc6490427", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002aa4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\apppatch\\sysmain.sdb" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1243 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc64902b3", "parentcaller": "0x7ffbc649003b", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a84" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7180000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x003e3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1244 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc6491830", "parentcaller": "0x7ffbc6491772", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7180000" }, { "name": "RegionSize", "value": "0x003e3000" } ], "repeated": 0, "id": 1245 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbaf987741", "parentcaller": "0x7ffbaf988661", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "38142214-ED63-4965-9214-1BBC06E130E9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8E1BBBB9-B3D5-430D-B276-D0E7454CAAB2" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1246 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbaf988695", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ploptin" }, { "name": "DllBase", "value": "0x7ffbba650000" } ], "repeated": 0, "id": 1247 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbaf988695", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00800000" }, { "name": "FileName", "value": "ploptin.dll" }, { "name": "BaseAddress", "value": "0x7ffbba650000" } ], "repeated": 0, "id": 1248 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc544acfe", "parentcaller": "0x7ffbaf9886fd", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ploptin" }, { "name": "DllBase", "value": "0x7ffbba650000" } ], "repeated": 0, "id": 1249 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc7bc0db0", "parentcaller": "0x7ffbc7b80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbba650000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1250 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a84" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1251 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc5433d8e", "parentcaller": "0x7ffbc5433354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002950" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1252 }, { "timestamp": "2026-05-28 23:34:21,568", "thread_id": "5816", "caller": "0x7ffbc5433395", "parentcaller": "0x7ffbc5433f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 1253 }, { "timestamp": "2026-05-28 23:34:22,677", "thread_id": "5044", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002aa4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079d0000" }, { "name": "SectionOffset", "value": "0x07ead000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1254 }, { "timestamp": "2026-05-28 23:34:22,677", "thread_id": "5044", "caller": "0x7ffbaf96d59f", "parentcaller": "0x7ffbaf9ac80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a84" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1255 }, { "timestamp": "2026-05-28 23:34:22,677", "thread_id": "5044", "caller": "0x7ffbaf96e842", "parentcaller": "0x7ffbaf96d62c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002abc" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1256 }, { "timestamp": "2026-05-28 23:34:22,677", "thread_id": "4828", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000240c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079d0000" }, { "name": "SectionOffset", "value": "0x02dff8e0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1257 }, { "timestamp": "2026-05-28 23:34:22,677", "thread_id": "4828", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f2a9000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1258 }, { "timestamp": "2026-05-28 23:34:22,677", "thread_id": "5144", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002aa4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079d0000" }, { "name": "SectionOffset", "value": "0x0a39f380" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1259 }, { "timestamp": "2026-05-28 23:34:22,677", "thread_id": "5044", "caller": "0x7ffbc649b8ed", "parentcaller": "0x7ffbc5c35341", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00002acc", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffbc5c353d0" }, { "name": "Parameter", "value": "0x047e8450" }, { "name": "CreationFlags", "value": "0x00000004" }, { "name": "ThreadId", "value": "3700" }, { "name": "ProcessId", "value": "4692" } ], "repeated": 0, "id": 1260 }, { "timestamp": "2026-05-28 23:34:22,677", "thread_id": "5044", "caller": "0x7ffbc549f430", "parentcaller": "0x7ffbc5c35379", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00002acc" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "3700" }, { "name": "ProcessId", "value": "4692" } ], "repeated": 0, "id": 1261 }, { "timestamp": "2026-05-28 23:34:22,693", "thread_id": "3700", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc703ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000289c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1262 }, { "timestamp": "2026-05-28 23:34:22,709", "thread_id": "4864", "caller": "0x7ff62761590b", "parentcaller": "0x7ff6276176b1", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\windows.internal.shell.broker" }, { "name": "DllBase", "value": "0x7ffbac200000" } ], "repeated": 0, "id": 1263 }, { "timestamp": "2026-05-28 23:34:22,709", "thread_id": "4864", "caller": "0x7ff62761590b", "parentcaller": "0x7ff6276176b1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\windows.internal.shell.broker.dll" }, { "name": "BaseAddress", "value": "0x7ffbac200000" } ], "repeated": 0, "id": 1264 }, { "timestamp": "2026-05-28 23:34:22,709", "thread_id": "5044", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001900" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079d0000" }, { "name": "SectionOffset", "value": "0x07eae080" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1265 }, { "timestamp": "2026-05-28 23:34:22,709", "thread_id": "4828", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002abc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079d0000" }, { "name": "SectionOffset", "value": "0x02dff8e0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1266 }, { "timestamp": "2026-05-28 23:34:22,756", "thread_id": "4644", "caller": "0x7ffbc544fcb5", "parentcaller": "0x7ffbc5495984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002acc" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1267 }, { "timestamp": "2026-05-28 23:34:22,756", "thread_id": "4644", "caller": "0x7ffbc544fcb5", "parentcaller": "0x7ffbc5495984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002acc" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1268 }, { "timestamp": "2026-05-28 23:34:22,756", "thread_id": "4644", "caller": "0x7ffbc544fcb5", "parentcaller": "0x7ffbc5495984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002acc" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1269 }, { "timestamp": "2026-05-28 23:34:22,756", "thread_id": "5044", "caller": "0x7ffbc5492a0c", "parentcaller": "0x7ffbb171f12b", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002abc" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 1, "id": 1270 }, { "timestamp": "2026-05-28 23:34:22,756", "thread_id": "5044", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002894" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1271 }, { "timestamp": "2026-05-28 23:34:22,756", "thread_id": "5044", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002944" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1272 }, { "timestamp": "2026-05-28 23:34:22,756", "thread_id": "5044", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002944" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1273 }, { "timestamp": "2026-05-28 23:34:22,756", "thread_id": "5044", "caller": "0x7ffbaf96d59f", "parentcaller": "0x7ffbaf9ac80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002ae0" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1274 }, { "timestamp": "2026-05-28 23:34:22,756", "thread_id": "4864", "caller": "0x7ff62767b354", "parentcaller": "0x7ff62767b12e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 1275 }, { "timestamp": "2026-05-28 23:34:22,756", "thread_id": "5816", "caller": "0x7ff62767bdd2", "parentcaller": "0x7ff62767a52a", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000288c" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1276 }, { "timestamp": "2026-05-28 23:34:22,756", "thread_id": "4828", "caller": "0x7ff62763c67f", "parentcaller": "0x7ff62763c407", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002aec" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7180000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x003e3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1277 }, { "timestamp": "2026-05-28 23:34:22,756", "thread_id": "5816", "caller": "0x7ff62767bdd2", "parentcaller": "0x7ff62767a52a", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000288c" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1278 }, { "timestamp": "2026-05-28 23:34:22,756", "thread_id": "5816", "caller": "0x7ff62767bdd2", "parentcaller": "0x7ff62767a52a", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000288c" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WindowsPowerShell\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1279 }, { "timestamp": "2026-05-28 23:34:22,756", "thread_id": "5816", "caller": "0x7ff62767a552", "parentcaller": "0x7ff627679a4f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 1280 }, { "timestamp": "2026-05-28 23:34:22,756", "thread_id": "5836", "caller": "0x7ff627679d60", "parentcaller": "0x7ff627679c74", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002af0" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1281 }, { "timestamp": "2026-05-28 23:34:22,756", "thread_id": "5816", "caller": "0x7ff62767a552", "parentcaller": "0x7ff627679a4f", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021e8" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1282 }, { "timestamp": "2026-05-28 23:34:22,756", "thread_id": "4828", "caller": "0x7ff62763a878", "parentcaller": "0x7ff62763a7ba", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7180000" }, { "name": "RegionSize", "value": "0x003e3000" } ], "repeated": 0, "id": 1283 }, { "timestamp": "2026-05-28 23:34:22,756", "thread_id": "5836", "caller": "0x7ff627679d60", "parentcaller": "0x7ff627679c74", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000287c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1284 }, { "timestamp": "2026-05-28 23:34:22,771", "thread_id": "6052", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc33c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x4574f454d" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1285 }, { "timestamp": "2026-05-28 23:34:22,771", "thread_id": "5816", "caller": "0x7ff6277adb8b", "parentcaller": "0x7ff627679a4f", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002888" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1286 }, { "timestamp": "2026-05-28 23:34:22,771", "thread_id": "5144", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 1287 }, { "timestamp": "2026-05-28 23:34:22,771", "thread_id": "5816", "caller": "0x7ff6277adb8b", "parentcaller": "0x7ff627679a4f", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002870" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1288 }, { "timestamp": "2026-05-28 23:34:22,771", "thread_id": "5816", "caller": "0x7ff6277adb8b", "parentcaller": "0x7ff627679a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001900" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1289 }, { "timestamp": "2026-05-28 23:34:22,771", "thread_id": "5816", "caller": "0x7ff6277adb8b", "parentcaller": "0x7ff627679a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001900" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1290 }, { "timestamp": "2026-05-28 23:34:22,771", "thread_id": "5816", "caller": "0x7ff6277adb8b", "parentcaller": "0x7ff627679a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001900" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1291 }, { "timestamp": "2026-05-28 23:34:22,771", "thread_id": "5816", "caller": "0x7ff6277adb8b", "parentcaller": "0x7ff627679a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001900" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1292 }, { "timestamp": "2026-05-28 23:34:22,771", "thread_id": "5816", "caller": "0x7ff6277adb8b", "parentcaller": "0x7ff627679a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001900" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1293 }, { "timestamp": "2026-05-28 23:34:22,771", "thread_id": "5816", "caller": "0x7ff6277adb8b", "parentcaller": "0x7ff627679a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001900" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1294 }, { "timestamp": "2026-05-28 23:34:22,771", "thread_id": "5816", "caller": "0x7ff6277adb8b", "parentcaller": "0x7ff627679a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001900" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1295 }, { "timestamp": "2026-05-28 23:34:22,771", "thread_id": "5816", "caller": "0x7ff6277adb8b", "parentcaller": "0x7ff627679a4f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00b78281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1296 }, { "timestamp": "2026-05-28 23:34:22,771", "thread_id": "5816", "caller": "0x7ff6277adb8b", "parentcaller": "0x7ff627679a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001900" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1297 }, { "timestamp": "2026-05-28 23:34:22,771", "thread_id": "5816", "caller": "0x7ff6277adb8b", "parentcaller": "0x7ff627679a4f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00b78281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1298 }, { "timestamp": "2026-05-28 23:34:22,771", "thread_id": "5816", "caller": "0x7ff6277adb8b", "parentcaller": "0x7ff627679a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001900" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1299 }, { "timestamp": "2026-05-28 23:34:22,771", "thread_id": "5816", "caller": "0x7ff6277adb8b", "parentcaller": "0x7ff627679a4f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00b78281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1300 }, { "timestamp": "2026-05-28 23:34:22,771", "thread_id": "5816", "caller": "0x7ff6277adb8b", "parentcaller": "0x7ff627679a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001900" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1301 }, { "timestamp": "2026-05-28 23:34:22,771", "thread_id": "5816", "caller": "0x7ff6277adb8b", "parentcaller": "0x7ff627679a4f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00b78281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1302 }, { "timestamp": "2026-05-28 23:34:22,771", "thread_id": "5816", "caller": "0x7ff6277adb8b", "parentcaller": "0x7ff627679a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001900" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1303 }, { "timestamp": "2026-05-28 23:34:22,771", "thread_id": "5816", "caller": "0x7ff6277adb8b", "parentcaller": "0x7ff627679a4f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001900" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1304 }, { "timestamp": "2026-05-28 23:34:22,771", "thread_id": "4864", "caller": "0x7ff62767a0c1", "parentcaller": "0x7ff627678f2b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 2, "id": 1305 }, { "timestamp": "2026-05-28 23:34:22,787", "thread_id": "4832", "caller": "0x7ff627640b6a", "parentcaller": "0x7ff627640a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000283c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\windowspowershell\\v1.0\\powershell.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1306 }, { "timestamp": "2026-05-28 23:34:22,787", "thread_id": "4832", "caller": "0x7ff627640b6a", "parentcaller": "0x7ff627640a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x00002864" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x115e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0007d000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1307 }, { "timestamp": "2026-05-28 23:34:22,787", "thread_id": "4832", "caller": "0x7ff627640b6a", "parentcaller": "0x7ff627640a51", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\windowspowershell\\SystemResources\\powershell.exe.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1308 }, { "timestamp": "2026-05-28 23:34:22,787", "thread_id": "4832", "caller": "0x7ff627640b6a", "parentcaller": "0x7ff627640a51", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x115e0000" }, { "name": "RegionSize", "value": "0x0007d000" } ], "repeated": 0, "id": 1309 }, { "timestamp": "2026-05-28 23:34:22,787", "thread_id": "4832", "caller": "0x7ff627640b6a", "parentcaller": "0x7ff627640a51", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002870" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 1310 }, { "timestamp": "2026-05-28 23:34:22,834", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002888" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000021e8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1311 }, { "timestamp": "2026-05-28 23:34:22,834", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000021e8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079d0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1312 }, { "timestamp": "2026-05-28 23:34:22,834", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002888" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002888" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1313 }, { "timestamp": "2026-05-28 23:34:22,834", "thread_id": "6052", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc33c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x4574f454d" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1314 }, { "timestamp": "2026-05-28 23:34:23,537", "thread_id": "4864", "caller": "0x7ff62767a0c1", "parentcaller": "0x7ff627678f2b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 1315 }, { "timestamp": "2026-05-28 23:34:24,006", "thread_id": "6052", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc33c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x4574f454d" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1316 }, { "timestamp": "2026-05-28 23:34:24,115", "thread_id": "4864", "caller": "0x7ff62767a0c1", "parentcaller": "0x7ff627678f2b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 1317 }, { "timestamp": "2026-05-28 23:34:24,490", "thread_id": "4732", "caller": "0x7ffbaf96e842", "parentcaller": "0x7ffbc7bc16e9", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000287c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1318 }, { "timestamp": "2026-05-28 23:34:24,506", "thread_id": "6052", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc33c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x4574f454d" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1319 }, { "timestamp": "2026-05-28 23:34:24,615", "thread_id": "4864", "caller": "0x7ff62767a0c1", "parentcaller": "0x7ff627678f2b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 1320 }, { "timestamp": "2026-05-28 23:34:27,709", "thread_id": "4644", "caller": "0x7ffbc544fcb5", "parentcaller": "0x7ffbc5495984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a4c" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1321 }, { "timestamp": "2026-05-28 23:34:27,709", "thread_id": "4644", "caller": "0x7ffbc544fcb5", "parentcaller": "0x7ffbc5495984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002ae8" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1322 }, { "timestamp": "2026-05-28 23:34:27,709", "thread_id": "4864", "caller": "0x7ff62767b354", "parentcaller": "0x7ff62767b12e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 1323 }, { "timestamp": "2026-05-28 23:34:27,709", "thread_id": "4824", "caller": "0x7ff62763ca89", "parentcaller": "0x7ff62763c93f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002870" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\apppatch\\sysmain.sdb" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1324 }, { "timestamp": "2026-05-28 23:34:27,709", "thread_id": "4824", "caller": "0x7ff62763c67f", "parentcaller": "0x7ff62763c407", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002ae8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7180000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x003e3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1325 }, { "timestamp": "2026-05-28 23:34:27,709", "thread_id": "5816", "caller": "0x7ff62767bdd2", "parentcaller": "0x7ff62767a52a", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002af4" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1326 }, { "timestamp": "2026-05-28 23:34:27,709", "thread_id": "5816", "caller": "0x7ff62767bdd2", "parentcaller": "0x7ff62767a52a", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002874" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1327 }, { "timestamp": "2026-05-28 23:34:27,709", "thread_id": "5816", "caller": "0x7ff62767a552", "parentcaller": "0x7ff627679a4f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 1328 }, { "timestamp": "2026-05-28 23:34:27,709", "thread_id": "4824", "caller": "0x7ff62763a878", "parentcaller": "0x7ff62763a7ba", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7180000" }, { "name": "RegionSize", "value": "0x003e3000" } ], "repeated": 0, "id": 1329 }, { "timestamp": "2026-05-28 23:34:27,709", "thread_id": "4864", "caller": "0x7ff62767a0c1", "parentcaller": "0x7ff627678f2b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 1330 }, { "timestamp": "2026-05-28 23:34:27,724", "thread_id": "4824", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbaf9b672b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001854" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\GameDVR\\KnownGameList.bin" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x0c\\xaf\\x04\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1331 }, { "timestamp": "2026-05-28 23:34:27,724", "thread_id": "4864", "caller": "0x7ff62767a0c1", "parentcaller": "0x7ff627666f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 1332 }, { "timestamp": "2026-05-28 23:34:27,724", "thread_id": "6052", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc33c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x4574f454d" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1333 }, { "timestamp": "2026-05-28 23:34:27,724", "thread_id": "5140", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 1, "id": 1334 }, { "timestamp": "2026-05-28 23:34:27,724", "thread_id": "5044", "caller": "0x7ffbaf96d59f", "parentcaller": "0x7ffbaf9ac80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002af4" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1335 }, { "timestamp": "2026-05-28 23:34:27,724", "thread_id": "4832", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000287c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079d0000" }, { "name": "SectionOffset", "value": "0x02e7d6d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1336 }, { "timestamp": "2026-05-28 23:34:27,724", "thread_id": "4832", "caller": "0x7ff627640b6a", "parentcaller": "0x7ff627640a51", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001900" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\program files (x86)\\microsoft\\Edge\\application\\msedge.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1337 }, { "timestamp": "2026-05-28 23:34:27,724", "thread_id": "4832", "caller": "0x7ff627640b6a", "parentcaller": "0x7ff627640a51", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x00002884" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x14fa0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00505000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1338 }, { "timestamp": "2026-05-28 23:34:27,724", "thread_id": "4832", "caller": "0x7ff627640b6a", "parentcaller": "0x7ff627640a51", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\program files (x86)\\microsoft\\Edge\\SystemResources\\msedge.exe.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1339 }, { "timestamp": "2026-05-28 23:34:27,724", "thread_id": "4832", "caller": "0x7ff627640b6a", "parentcaller": "0x7ff627640a51", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x14fa0000" }, { "name": "RegionSize", "value": "0x00505000" } ], "repeated": 0, "id": 1340 }, { "timestamp": "2026-05-28 23:34:27,724", "thread_id": "5044", "caller": "0x7ffbaf96e842", "parentcaller": "0x7ffbaf96d62c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1341 }, { "timestamp": "2026-05-28 23:34:29,021", "thread_id": "4732", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000283c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079d0000" }, { "name": "SectionOffset", "value": "0x09c2ef00" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1342 }, { "timestamp": "2026-05-28 23:34:29,021", "thread_id": "4732", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000283c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079d0000" }, { "name": "SectionOffset", "value": "0x09c2eca0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1343 }, { "timestamp": "2026-05-28 23:34:29,021", "thread_id": "4732", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f2ba000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1344 }, { "timestamp": "2026-05-28 23:34:29,021", "thread_id": "5044", "caller": "0x7ffbaf96d59f", "parentcaller": "0x7ffbaf9ac80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002b00" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1345 }, { "timestamp": "2026-05-28 23:34:29,021", "thread_id": "4188", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002874" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079d0000" }, { "name": "SectionOffset", "value": "0x0956d900" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1346 }, { "timestamp": "2026-05-28 23:34:29,349", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002af4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002af0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1347 }, { "timestamp": "2026-05-28 23:34:29,349", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002af0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079d0000" }, { "name": "SectionOffset", "value": "0x073ff170" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1348 }, { "timestamp": "2026-05-28 23:34:29,412", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002874" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002af4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1349 }, { "timestamp": "2026-05-28 23:34:29,412", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002af4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079d0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1350 }, { "timestamp": "2026-05-28 23:34:29,412", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002874" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002874" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1351 }, { "timestamp": "2026-05-28 23:34:29,412", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002870" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000494" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1352 }, { "timestamp": "2026-05-28 23:34:29,412", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000494" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079d0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1353 }, { "timestamp": "2026-05-28 23:34:29,412", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002870" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002870" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1354 }, { "timestamp": "2026-05-28 23:34:29,412", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002868" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002944" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1355 }, { "timestamp": "2026-05-28 23:34:29,412", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002944" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079d0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1356 }, { "timestamp": "2026-05-28 23:34:29,412", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002868" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002868" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1357 }, { "timestamp": "2026-05-28 23:34:29,412", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002864" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002afc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1358 }, { "timestamp": "2026-05-28 23:34:29,412", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002afc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079d0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1359 }, { "timestamp": "2026-05-28 23:34:29,412", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002864" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002864" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1360 }, { "timestamp": "2026-05-28 23:34:29,412", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002874" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002870" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1361 }, { "timestamp": "2026-05-28 23:34:29,412", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002870" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079d0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1362 }, { "timestamp": "2026-05-28 23:34:29,412", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002874" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002874" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1363 }, { "timestamp": "2026-05-28 23:34:29,427", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000290c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002864" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1364 }, { "timestamp": "2026-05-28 23:34:29,427", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002864" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079d0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1365 }, { "timestamp": "2026-05-28 23:34:29,427", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000290c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000290c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1366 }, { "timestamp": "2026-05-28 23:34:29,427", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001900" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002874" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1367 }, { "timestamp": "2026-05-28 23:34:29,427", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002874" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079d0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1368 }, { "timestamp": "2026-05-28 23:34:29,427", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001900" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001900" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1369 }, { "timestamp": "2026-05-28 23:34:29,427", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029ac" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002868" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1370 }, { "timestamp": "2026-05-28 23:34:29,427", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002868" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079d0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1371 }, { "timestamp": "2026-05-28 23:34:29,427", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029ac" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029ac" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1372 }, { "timestamp": "2026-05-28 23:34:29,427", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000029ac" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1373 }, { "timestamp": "2026-05-28 23:34:29,427", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002ae4" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1374 }, { "timestamp": "2026-05-28 23:34:29,427", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002940" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1375 }, { "timestamp": "2026-05-28 23:34:29,427", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002900" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1376 }, { "timestamp": "2026-05-28 23:34:29,427", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002aa8" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1377 }, { "timestamp": "2026-05-28 23:34:29,427", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002938" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1378 }, { "timestamp": "2026-05-28 23:34:29,427", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000292c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1379 }, { "timestamp": "2026-05-28 23:34:29,427", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000028f8" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1380 }, { "timestamp": "2026-05-28 23:34:29,427", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002aa0" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1381 }, { "timestamp": "2026-05-28 23:34:29,427", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002910" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1382 }, { "timestamp": "2026-05-28 23:34:29,427", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002958" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Burn" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1383 }, { "timestamp": "2026-05-28 23:34:29,443", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002884" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Burn" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1384 }, { "timestamp": "2026-05-28 23:34:29,443", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000295c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1385 }, { "timestamp": "2026-05-28 23:34:29,443", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000934" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1386 }, { "timestamp": "2026-05-28 23:34:29,443", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002930" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1387 }, { "timestamp": "2026-05-28 23:34:29,443", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002908" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1388 }, { "timestamp": "2026-05-28 23:34:29,443", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002934" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1389 }, { "timestamp": "2026-05-28 23:34:29,443", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000028ec" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1390 }, { "timestamp": "2026-05-28 23:34:29,443", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a8c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1391 }, { "timestamp": "2026-05-28 23:34:29,443", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000290c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1392 }, { "timestamp": "2026-05-28 23:34:29,537", "thread_id": "4188", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002870" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079d0000" }, { "name": "SectionOffset", "value": "0x0956d900" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1393 }, { "timestamp": "2026-05-28 23:34:29,537", "thread_id": "4732", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000028fc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079d0000" }, { "name": "SectionOffset", "value": "0x09c2eca0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1394 }, { "timestamp": "2026-05-28 23:34:29,552", "thread_id": "4732", "caller": "0x7ffbc6494db6", "parentcaller": "0x7ffbc6493b55", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002944" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "C:\\Windows\\System32\\twinui.pcshell.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1395 }, { "timestamp": "2026-05-28 23:34:29,552", "thread_id": "4732", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbb03d22b4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "comctl32.dll" }, { "name": "BaseAddress", "value": "0x7ffbb1750000" } ], "repeated": 1, "id": 1396 }, { "timestamp": "2026-05-28 23:34:31,912", "thread_id": "4864", "caller": "0x7ff62767a0c1", "parentcaller": "0x7ff627666f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 20, "id": 1397 }, { "timestamp": "2026-05-28 23:34:32,474", "thread_id": "4644", "caller": "0x7ffbc544fcb5", "parentcaller": "0x7ffbc5495984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002ab4" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1398 }, { "timestamp": "2026-05-28 23:34:32,474", "thread_id": "4644", "caller": "0x7ffbc544fcb5", "parentcaller": "0x7ffbc5495984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002ab4" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1399 }, { "timestamp": "2026-05-28 23:34:32,474", "thread_id": "4644", "caller": "0x7ffbc544fcb5", "parentcaller": "0x7ffbc5495984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002ab4" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1400 }, { "timestamp": "2026-05-28 23:34:32,506", "thread_id": "5836", "caller": "0x7ff627679d60", "parentcaller": "0x7ff627679c74", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 1401 }, { "timestamp": "2026-05-28 23:34:32,506", "thread_id": "5836", "caller": "0x7ff627679d60", "parentcaller": "0x7ff627679c74", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002af4" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 1, "id": 1402 }, { "timestamp": "2026-05-28 23:34:32,506", "thread_id": "5836", "caller": "0x7ff627679d60", "parentcaller": "0x7ff627679c74", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002af0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1403 }, { "timestamp": "2026-05-28 23:34:32,506", "thread_id": "5044", "caller": "0x7ffbaf96e842", "parentcaller": "0x7ffbaf96d62c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002b00" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1404 }, { "timestamp": "2026-05-28 23:34:32,521", "thread_id": "6052", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc33c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x4574f454d" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1405 }, { "timestamp": "2026-05-28 23:34:32,521", "thread_id": "5140", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 1406 }, { "timestamp": "2026-05-28 23:34:32,552", "thread_id": "5824", "caller": "0x7ffbaf96e842", "parentcaller": "0x7ffbc7bc16e9", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002b28" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1407 }, { "timestamp": "2026-05-28 23:34:34,068", "thread_id": "5044", "caller": "0x7ffbaf96d59f", "parentcaller": "0x7ffbaf9ac80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021e8" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1408 }, { "timestamp": "2026-05-28 23:34:34,084", "thread_id": "5044", "caller": "0x7ffbaf96e842", "parentcaller": "0x7ffbaf96d62c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002b10" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1409 }, { "timestamp": "2026-05-28 23:34:34,240", "thread_id": "4864", "caller": "0x7ff62767a0c1", "parentcaller": "0x7ff627666f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 15, "id": 1410 }, { "timestamp": "2026-05-28 23:34:38,521", "thread_id": "4864", "caller": "0x7ff62765652c", "parentcaller": "0x7ff627655d54", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7ffbc4230000" } ], "repeated": 1, "id": 1411 }, { "timestamp": "2026-05-28 23:34:38,521", "thread_id": "4864", "caller": "0x7ff6276623a8", "parentcaller": "0x7ff627662e19", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002af0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\SecurityHealthSSO.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1412 }, { "timestamp": "2026-05-28 23:34:38,521", "thread_id": "4864", "caller": "0x7ff6276623a8", "parentcaller": "0x7ff627662e19", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000287c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13230000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000eb000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1413 }, { "timestamp": "2026-05-28 23:34:38,521", "thread_id": "4864", "caller": "0x7ff6276623a8", "parentcaller": "0x7ff627662e19", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x13230000" }, { "name": "RegionSize", "value": "0x000eb000" } ], "repeated": 0, "id": 1414 }, { "timestamp": "2026-05-28 23:34:39,068", "thread_id": "5824", "caller": "0x7ffbaf96e842", "parentcaller": "0x7ffbc7bc16e9", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002b20" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1415 }, { "timestamp": "2026-05-28 23:34:42,177", "thread_id": "5008", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 3, "id": 1416 }, { "timestamp": "2026-05-28 23:34:44,037", "thread_id": "4744", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc71f6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000010e8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1417 }, { "timestamp": "2026-05-28 23:34:45,302", "thread_id": "4788", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc703ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000f04" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1418 }, { "timestamp": "2026-05-28 23:34:46,256", "thread_id": "5856", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1419 }, { "timestamp": "2026-05-28 23:34:49,209", "thread_id": "5832", "caller": "0x7ffbaf96e842", "parentcaller": "0x7ffbc7bc16e9", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002260" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1420 }, { "timestamp": "2026-05-28 23:34:50,099", "thread_id": "4864", "caller": "0x7ff627727be7", "parentcaller": "0x7ff627724fa0", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002264" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-LIGHT.svg" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1421 }, { "timestamp": "2026-05-28 23:34:50,131", "thread_id": "4864", "caller": "0x7ff62772c53a", "parentcaller": "0x7ff627727dd7", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002264" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-LIGHT.svg" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1422 }, { "timestamp": "2026-05-28 23:34:50,131", "thread_id": "4864", "caller": "0x7ff62772c53a", "parentcaller": "0x7ff627727dd7", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002264" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-LIGHT.svg" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1423 }, { "timestamp": "2026-05-28 23:34:50,146", "thread_id": "4864", "caller": "0x7ff62772c53a", "parentcaller": "0x7ff627727dd7", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a1a0000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1424 }, { "timestamp": "2026-05-28 23:34:50,146", "thread_id": "4864", "caller": "0x7ff62772c53a", "parentcaller": "0x7ff627727dd7", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a1a5000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1425 }, { "timestamp": "2026-05-28 23:34:50,146", "thread_id": "4864", "caller": "0x7ff62772c53a", "parentcaller": "0x7ff627727dd7", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a1a8000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1426 }, { "timestamp": "2026-05-28 23:34:50,146", "thread_id": "4864", "caller": "0x7ff62772c53a", "parentcaller": "0x7ff627727dd7", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a1ad000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1427 }, { "timestamp": "2026-05-28 23:34:50,146", "thread_id": "4864", "caller": "0x7ff627727e2d", "parentcaller": "0x7ff627724fa0", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000269c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-DARK.svg" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1428 }, { "timestamp": "2026-05-28 23:34:50,146", "thread_id": "4864", "caller": "0x7ff627727e2d", "parentcaller": "0x7ff627724fa0", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a1b0000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1429 }, { "timestamp": "2026-05-28 23:34:50,146", "thread_id": "4864", "caller": "0x7ff62772c53a", "parentcaller": "0x7ff627727e74", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000269c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-DARK.svg" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1430 }, { "timestamp": "2026-05-28 23:34:50,146", "thread_id": "4864", "caller": "0x7ff62772c53a", "parentcaller": "0x7ff627727e74", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000269c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-DARK.svg" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1431 }, { "timestamp": "2026-05-28 23:34:50,162", "thread_id": "4864", "caller": "0x7ff62772c53a", "parentcaller": "0x7ff627727e74", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a1b2000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1432 }, { "timestamp": "2026-05-28 23:34:50,162", "thread_id": "4864", "caller": "0x7ff62772c53a", "parentcaller": "0x7ff627727e74", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a1b5000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1433 }, { "timestamp": "2026-05-28 23:34:50,162", "thread_id": "4864", "caller": "0x7ff62772c53a", "parentcaller": "0x7ff627727e74", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a1ba000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1434 }, { "timestamp": "2026-05-28 23:34:50,162", "thread_id": "4864", "caller": "0x7ff62772c53a", "parentcaller": "0x7ff627727e74", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a1bd000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1435 }, { "timestamp": "2026-05-28 23:34:50,162", "thread_id": "4864", "caller": "0x7ff62772c53a", "parentcaller": "0x7ff627727e74", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a1c0000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1436 }, { "timestamp": "2026-05-28 23:34:50,162", "thread_id": "4864", "caller": "0x7ff62772c53a", "parentcaller": "0x7ff627727e74", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a1c3000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1437 }, { "timestamp": "2026-05-28 23:34:50,162", "thread_id": "4864", "caller": "0x7ff62772c53a", "parentcaller": "0x7ff627727e74", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a1c8000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1438 }, { "timestamp": "2026-05-28 23:34:50,177", "thread_id": "4864", "caller": "0x7ff62772c53a", "parentcaller": "0x7ff627727e74", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a1cb000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1439 }, { "timestamp": "2026-05-28 23:34:50,177", "thread_id": "4864", "caller": "0x7ff62772c53a", "parentcaller": "0x7ff627727e74", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a1ce000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1440 }, { "timestamp": "2026-05-28 23:34:50,177", "thread_id": "4864", "caller": "0x7ff62772c53a", "parentcaller": "0x7ff627727e74", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a1d3000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1441 }, { "timestamp": "2026-05-28 23:34:50,193", "thread_id": "4864", "caller": "0x7ff62772de16", "parentcaller": "0x7ff62772c0ee", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a1d8000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1442 }, { "timestamp": "2026-05-28 23:34:50,193", "thread_id": "4864", "caller": "0x7ff62772de16", "parentcaller": "0x7ff62772c0ee", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a1dd000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1443 }, { "timestamp": "2026-05-28 23:34:50,193", "thread_id": "4864", "caller": "0x7ff62772de16", "parentcaller": "0x7ff62772c0ee", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a1e0000" }, { "name": "RegionSize", "value": "0x00021000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1444 }, { "timestamp": "2026-05-28 23:34:50,193", "thread_id": "4864", "caller": "0x7ff62772de16", "parentcaller": "0x7ff62772c0ee", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a201000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1445 }, { "timestamp": "2026-05-28 23:34:50,256", "thread_id": "4864", "caller": "0x7ff62772de16", "parentcaller": "0x7ff62772c0ee", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f2cb000" }, { "name": "RegionSize", "value": "0x00043000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1446 }, { "timestamp": "2026-05-28 23:34:50,256", "thread_id": "4864", "caller": "0x7ff62772de16", "parentcaller": "0x7ff62772c0ee", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a204000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1447 }, { "timestamp": "2026-05-28 23:34:50,256", "thread_id": "4864", "caller": "0x7ff62772de16", "parentcaller": "0x7ff62772c0ee", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a207000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1448 }, { "timestamp": "2026-05-28 23:34:50,256", "thread_id": "4864", "caller": "0x7ff62772de16", "parentcaller": "0x7ff62772c0ee", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a20a000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1449 }, { "timestamp": "2026-05-28 23:34:50,256", "thread_id": "4864", "caller": "0x7ff62772de16", "parentcaller": "0x7ff62772c0ee", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a20d000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1450 }, { "timestamp": "2026-05-28 23:34:50,256", "thread_id": "4864", "caller": "0x7ff62772de16", "parentcaller": "0x7ff62772c0ee", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f30e000" }, { "name": "RegionSize", "value": "0x00043000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1451 }, { "timestamp": "2026-05-28 23:34:50,256", "thread_id": "4864", "caller": "0x7ff62772de16", "parentcaller": "0x7ff62772c0ee", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a210000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1452 }, { "timestamp": "2026-05-28 23:34:50,256", "thread_id": "4864", "caller": "0x7ff62772de16", "parentcaller": "0x7ff62772c0ee", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a213000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1453 }, { "timestamp": "2026-05-28 23:34:50,256", "thread_id": "4864", "caller": "0x7ff62772de16", "parentcaller": "0x7ff62772c0ee", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a216000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1454 }, { "timestamp": "2026-05-28 23:34:50,256", "thread_id": "4864", "caller": "0x7ff62772de16", "parentcaller": "0x7ff62772c0ee", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a21b000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1455 }, { "timestamp": "2026-05-28 23:34:50,256", "thread_id": "4864", "caller": "0x7ff62772de16", "parentcaller": "0x7ff62772c0ee", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f351000" }, { "name": "RegionSize", "value": "0x00043000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1456 }, { "timestamp": "2026-05-28 23:34:50,271", "thread_id": "4864", "caller": "0x7ff62768984c", "parentcaller": "0x7ff6276897dc", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002260" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002264" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1457 }, { "timestamp": "2026-05-28 23:34:50,302", "thread_id": "5832", "caller": "0x7ffbc7bc1963", "parentcaller": "0x7ffbc7bc1798", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x009bf000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1458 }, { "timestamp": "2026-05-28 23:34:50,302", "thread_id": "5832", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b764ab", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f391000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1459 }, { "timestamp": "2026-05-28 23:34:50,334", "thread_id": "4864", "caller": "0x7ff62768984c", "parentcaller": "0x7ff6276897dc", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ea1b000" }, { "name": "RegionSize", "value": "0x00034000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1460 }, { "timestamp": "2026-05-28 23:34:50,334", "thread_id": "4864", "caller": "0x7ff62768984c", "parentcaller": "0x7ff6276897dc", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ea54000" }, { "name": "RegionSize", "value": "0x00040000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1461 }, { "timestamp": "2026-05-28 23:34:52,927", "thread_id": "4644", "caller": "0x7ffbc544fcb5", "parentcaller": "0x7ffbc5495984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002008" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1462 }, { "timestamp": "2026-05-28 23:34:52,927", "thread_id": "4644", "caller": "0x7ffbc544fcb5", "parentcaller": "0x7ffbc5495984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002008" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1463 }, { "timestamp": "2026-05-28 23:34:52,927", "thread_id": "2404", "caller": "0x7ff627679d60", "parentcaller": "0x7ff627679c74", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 1464 }, { "timestamp": "2026-05-28 23:34:52,927", "thread_id": "5044", "caller": "0x7ffbaf96d59f", "parentcaller": "0x7ffbaf9ac80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000240c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1465 }, { "timestamp": "2026-05-28 23:34:52,927", "thread_id": "5044", "caller": "0x7ffbaf96e842", "parentcaller": "0x7ffbaf96d62c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002268" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1466 }, { "timestamp": "2026-05-28 23:34:52,943", "thread_id": "6052", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc33c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x4574f454d" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1467 }, { "timestamp": "2026-05-28 23:34:52,943", "thread_id": "5144", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 1468 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002084" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000880" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1469 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000880" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07980000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1470 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002084" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002084" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1471 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000020a0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002084" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1472 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002084" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07980000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1473 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000020a0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000020a0" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1474 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002278" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000020a0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1475 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000020a0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07980000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1476 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002278" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002278" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1477 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000227c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028a0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1478 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000028a0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07980000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1479 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000227c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000227c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1480 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000bac" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000227c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1481 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000227c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07980000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1482 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000bac" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000bac" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1483 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002278" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000020a0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1484 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000020a0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07980000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1485 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002278" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002278" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1486 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f38" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000020a0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1487 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000020a0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07980000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1488 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f38" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f38" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1489 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000226c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000bac" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1490 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000bac" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07980000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1491 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000226c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000226c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1492 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000226c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1493 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000b90" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1494 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000be0" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1495 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000cb0" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1496 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000c1c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1497 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000bf4" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1498 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000020a0" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1499 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f38" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1500 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001fb8" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1501 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002268" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1502 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002094" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Burn" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1503 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000240c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Burn" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1504 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000093c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1505 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002ac8" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1506 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000289c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1507 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000269c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1508 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021f4" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1509 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002728" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1510 }, { "timestamp": "2026-05-28 23:34:56,662", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000225c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1511 }, { "timestamp": "2026-05-28 23:34:56,677", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000224c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1512 }, { "timestamp": "2026-05-28 23:34:58,037", "thread_id": "5852", "caller": "0x7ffbaf96e842", "parentcaller": "0x7ffbc7bc16e9", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000bb0" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1513 }, { "timestamp": "2026-05-28 23:34:58,412", "thread_id": "4864", "caller": "0x7ff62767b354", "parentcaller": "0x7ff62767b12e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 1514 }, { "timestamp": "2026-05-28 23:34:58,412", "thread_id": "4828", "caller": "0x7ff62763ca89", "parentcaller": "0x7ff62763c93f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000020ec" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\apppatch\\sysmain.sdb" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1515 }, { "timestamp": "2026-05-28 23:34:58,427", "thread_id": "4828", "caller": "0x7ff62763c67f", "parentcaller": "0x7ff62763c407", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002128" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7180000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x003e3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1516 }, { "timestamp": "2026-05-28 23:34:58,427", "thread_id": "5852", "caller": "0x7ff62767bdd2", "parentcaller": "0x7ff62767a52a", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a10" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1517 }, { "timestamp": "2026-05-28 23:34:58,427", "thread_id": "5852", "caller": "0x7ff62767bdd2", "parentcaller": "0x7ff62767a52a", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a14" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1518 }, { "timestamp": "2026-05-28 23:34:58,427", "thread_id": "5044", "caller": "0x7ffbc544fcb5", "parentcaller": "0x7ffbc5495984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000020ac" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1519 }, { "timestamp": "2026-05-28 23:34:58,427", "thread_id": "5852", "caller": "0x7ff62767a552", "parentcaller": "0x7ff627679a4f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 1520 }, { "timestamp": "2026-05-28 23:34:58,427", "thread_id": "5044", "caller": "0x7ffbc544fcb5", "parentcaller": "0x7ffbc5495984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a14" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1521 }, { "timestamp": "2026-05-28 23:34:58,427", "thread_id": "2404", "caller": "0x7ff627679d60", "parentcaller": "0x7ff627679c74", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 1522 }, { "timestamp": "2026-05-28 23:34:58,427", "thread_id": "5852", "caller": "0x7ff62767a552", "parentcaller": "0x7ff627679a4f", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a14" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1523 }, { "timestamp": "2026-05-28 23:34:58,427", "thread_id": "5852", "caller": "0x7ff62767a552", "parentcaller": "0x7ff627679a4f", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a14" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1524 }, { "timestamp": "2026-05-28 23:34:58,427", "thread_id": "5044", "caller": "0x7ffbc649b8ed", "parentcaller": "0x7ffbc5c35341", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x000028a0", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffbc5c353d0" }, { "name": "Parameter", "value": "0x047e8370" }, { "name": "CreationFlags", "value": "0x00000004" }, { "name": "ThreadId", "value": "5260" }, { "name": "ProcessId", "value": "4692" } ], "repeated": 0, "id": 1525 }, { "timestamp": "2026-05-28 23:34:58,427", "thread_id": "5044", "caller": "0x7ffbc549f430", "parentcaller": "0x7ffbc5c35379", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x000028a0" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "5260" }, { "name": "ProcessId", "value": "4692" } ], "repeated": 0, "id": 1526 }, { "timestamp": "2026-05-28 23:34:58,427", "thread_id": "5140", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbaf9b672b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001854" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\GameDVR\\KnownGameList.bin" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x0c\\xaf\\x04\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1527 }, { "timestamp": "2026-05-28 23:34:58,427", "thread_id": "5260", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc703ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000bfc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1528 }, { "timestamp": "2026-05-28 23:34:58,427", "thread_id": "6052", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc33c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x4574f454d" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1529 }, { "timestamp": "2026-05-28 23:34:58,427", "thread_id": "4828", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 1, "id": 1530 }, { "timestamp": "2026-05-28 23:34:58,740", "thread_id": "4748", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f0d8000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1531 }, { "timestamp": "2026-05-28 23:34:58,740", "thread_id": "4748", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.Shell.ServiceHostBuilder" }, { "name": "DllBase", "value": "0x7ffbb4b60000" } ], "repeated": 0, "id": 1532 }, { "timestamp": "2026-05-28 23:34:58,740", "thread_id": "4748", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\Windows.Shell.ServiceHostBuilder.dll" }, { "name": "BaseAddress", "value": "0x7ffbb4b60000" } ], "repeated": 0, "id": 1533 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "4748", "caller": "0x7ffbc649b8ed", "parentcaller": "0x7ffbc5c46d18", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000b84", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffbc5c4be80" }, { "name": "Parameter", "value": "0x09aad330" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "3100" }, { "name": "ProcessId", "value": "4692" } ], "repeated": 0, "id": 1534 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "3100", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc544e6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "D3D10Warp.dll" }, { "name": "BaseAddress", "value": "0x7ffbbdd10000" } ], "repeated": 0, "id": 1535 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "3100", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc544e6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "gdi32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc6d10000" } ], "repeated": 1, "id": 1536 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "3100", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc3b01bd0", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "d3d10warp.dll" }, { "name": "BaseAddress", "value": "0x7ffbbdd10000" } ], "repeated": 0, "id": 1537 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "3100", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f1fc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1538 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "3100", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455f3e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000bec" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\explorer.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1539 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "3100", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f0bf000" }, { "name": "RegionSize", "value": "0x0000c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1540 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "3100", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f109000" }, { "name": "RegionSize", "value": "0x00006000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1541 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "3100", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f099000" }, { "name": "RegionSize", "value": "0x0000d000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1542 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "3100", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x088b1000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1543 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "3100", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000e54" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\d3d10warp.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1544 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "3100", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc282a36b", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000e54" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1545 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "3100", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc2849362", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002324" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1546 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "3100", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d60e000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1547 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "3100", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbc1ebe2ba", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08fb0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1548 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "3100", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f14f000" }, { "name": "RegionSize", "value": "0x0003f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1549 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "3100", "caller": "0x7ffbc5c3f55f", "parentcaller": "0x7ffbc5c2705e", "category": "system", "api": "SetWindowsHookExW", "status": true, "return": "0x0008042b", "arguments": [ { "name": "HookIdentifier", "value": "4", "pretty_value": "WH_CALLWNDPROC" }, { "name": "ProcedureAddress", "value": "0x7ffbc5c3fa40" }, { "name": "ModuleAddress", "value": "0x7ffbc5c20000" }, { "name": "ThreadId", "value": "3100" } ], "repeated": 0, "id": 1550 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "3100", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc703ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000020e8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1551 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "4868", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08fd0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1552 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "4868", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7560000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1553 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "4868", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059db5", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7560000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1554 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "4868", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059f77", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7560000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1555 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "4868", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059f77", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7561000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x40000020", "pretty_value": "PAGE_EXECUTE_READ|0x40000000" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1556 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "4868", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0da39000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1557 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "3100", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f0e5000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1558 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "3100", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f05e000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1559 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "3100", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08fd0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1560 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "3100", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f051000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1561 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "3100", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08fe0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1562 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "5856", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0eb00000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1563 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "5856", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08ff0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1564 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "4868", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09000000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1565 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "3100", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09010000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1566 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "4868", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09290000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1567 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "5856", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092a0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1568 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "3100", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc1c15dbb", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002aec" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002acc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1569 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "4868", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7550000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1570 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "5856", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092b0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1571 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "4868", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059db5", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7550000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1572 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "4868", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059f77", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7550000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1573 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "3100", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002aec" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092c0000" }, { "name": "SectionOffset", "value": "0x08f9f0a0" }, { "name": "ViewSize", "value": "0x00004000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1574 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "5856", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7540000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1575 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "5856", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059db5", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7540000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1576 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "5856", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059f77", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7540000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1577 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "3100", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002aec" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092d0000" }, { "name": "SectionOffset", "value": "0x08f9f550" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1578 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "3100", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002acc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092d0000" }, { "name": "SectionOffset", "value": "0x08f9f610" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1579 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "3100", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002acc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092d0000" }, { "name": "SectionOffset", "value": "0x08f9f610" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1580 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "3100", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000d7c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092d0000" }, { "name": "SectionOffset", "value": "0x08f9f780" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1581 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "5044", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002080" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092d0000" }, { "name": "SectionOffset", "value": "0x07eaf240" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1582 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "3100", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000d7c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092e0000" }, { "name": "SectionOffset", "value": "0x08f9f650" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1583 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "3100", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000d7c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092d0000" }, { "name": "SectionOffset", "value": "0x08f9f650" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1584 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "4868", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059f77", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7551000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x40000020", "pretty_value": "PAGE_EXECUTE_READ|0x40000000" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1585 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "5044", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002080" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09000000" }, { "name": "SectionOffset", "value": "0x07eaf240" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1586 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "5856", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059f77", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7541000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x40000020", "pretty_value": "PAGE_EXECUTE_READ|0x40000000" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1587 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "5856", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0e887000" }, { "name": "RegionSize", "value": "0x000c8000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1588 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "5020", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0edcf000" }, { "name": "RegionSize", "value": "0x000c8000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1589 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "5856", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0e955000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1590 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "4868", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08ff0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1591 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "4868", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09000000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1592 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "4868", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7530000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1593 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "4868", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059db5", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7530000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1594 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "4868", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059f77", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7530000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1595 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "4868", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059f77", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7531000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x40000020", "pretty_value": "PAGE_EXECUTE_READ|0x40000000" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1596 }, { "timestamp": "2026-05-28 23:34:58,756", "thread_id": "5044", "caller": "0x7ffbaf96d59f", "parentcaller": "0x7ffbaf9ac80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f28" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1597 }, { "timestamp": "2026-05-28 23:34:58,771", "thread_id": "3100", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ea9a000" }, { "name": "RegionSize", "value": "0x00044000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1598 }, { "timestamp": "2026-05-28 23:34:58,771", "thread_id": "3100", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09290000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1599 }, { "timestamp": "2026-05-28 23:34:58,771", "thread_id": "3100", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f0ad000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1600 }, { "timestamp": "2026-05-28 23:34:58,771", "thread_id": "3100", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc1c15dbb", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000233c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002334" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1601 }, { "timestamp": "2026-05-28 23:34:58,771", "thread_id": "5816", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f394000" }, { "name": "RegionSize", "value": "0x000c9000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1602 }, { "timestamp": "2026-05-28 23:34:58,771", "thread_id": "5816", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b6f120", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f347000" }, { "name": "RegionSize", "value": "0x0004c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1603 }, { "timestamp": "2026-05-28 23:34:58,771", "thread_id": "5020", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0e9c8000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1604 }, { "timestamp": "2026-05-28 23:34:58,771", "thread_id": "5856", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f45d000" }, { "name": "RegionSize", "value": "0x000c9000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1605 }, { "timestamp": "2026-05-28 23:34:58,771", "thread_id": "4868", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092a0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1606 }, { "timestamp": "2026-05-28 23:34:58,771", "thread_id": "4868", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092b0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1607 }, { "timestamp": "2026-05-28 23:34:58,771", "thread_id": "4868", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7520000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1608 }, { "timestamp": "2026-05-28 23:34:58,771", "thread_id": "4868", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059db5", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7520000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1609 }, { "timestamp": "2026-05-28 23:34:58,771", "thread_id": "4868", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059f77", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7520000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1610 }, { "timestamp": "2026-05-28 23:34:58,771", "thread_id": "4868", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059f77", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7521000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x40000020", "pretty_value": "PAGE_EXECUTE_READ|0x40000000" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1611 }, { "timestamp": "2026-05-28 23:34:58,771", "thread_id": "4868", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0da3a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1612 }, { "timestamp": "2026-05-28 23:34:58,771", "thread_id": "3100", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc1c15dbb", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a10" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001ee8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1613 }, { "timestamp": "2026-05-28 23:34:58,771", "thread_id": "3100", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f2a5000" }, { "name": "RegionSize", "value": "0x00006000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1614 }, { "timestamp": "2026-05-28 23:34:58,771", "thread_id": "3100", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a21e000" }, { "name": "RegionSize", "value": "0x0001b000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1615 }, { "timestamp": "2026-05-28 23:34:58,771", "thread_id": "3100", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0edad000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1616 }, { "timestamp": "2026-05-28 23:34:58,771", "thread_id": "4748", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 1617 }, { "timestamp": "2026-05-28 23:34:58,771", "thread_id": "4828", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\activationclient" }, { "name": "DllBase", "value": "0x7ffbbd8b0000" } ], "repeated": 0, "id": 1618 }, { "timestamp": "2026-05-28 23:34:58,771", "thread_id": "4828", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\activationclient.dll" }, { "name": "BaseAddress", "value": "0x7ffbbd8b0000" } ], "repeated": 0, "id": 1619 }, { "timestamp": "2026-05-28 23:34:58,787", "thread_id": "4748", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0efb7000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1620 }, { "timestamp": "2026-05-28 23:34:58,787", "thread_id": "5044", "caller": "0x7ffbc649b8ed", "parentcaller": "0x7ffbc5c35341", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00002120", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffbc5c353d0" }, { "name": "Parameter", "value": "0x047e7f10" }, { "name": "CreationFlags", "value": "0x00000004" }, { "name": "ThreadId", "value": "10140" }, { "name": "ProcessId", "value": "4692" } ], "repeated": 0, "id": 1621 }, { "timestamp": "2026-05-28 23:34:58,787", "thread_id": "5044", "caller": "0x7ffbc549f430", "parentcaller": "0x7ffbc5c35379", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00002120" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "10140" }, { "name": "ProcessId", "value": "4692" } ], "repeated": 0, "id": 1622 }, { "timestamp": "2026-05-28 23:34:58,834", "thread_id": "3100", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002914" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092a0000" }, { "name": "SectionOffset", "value": "0x08f9e6f0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1623 }, { "timestamp": "2026-05-28 23:34:58,834", "thread_id": "3100", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000028ec" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092a0000" }, { "name": "SectionOffset", "value": "0x08f9e550" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1624 }, { "timestamp": "2026-05-28 23:34:58,834", "thread_id": "3100", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000028ec" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092a0000" }, { "name": "SectionOffset", "value": "0x08f9e4e0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1625 }, { "timestamp": "2026-05-28 23:34:58,834", "thread_id": "4864", "caller": "0x7ff62767a0c1", "parentcaller": "0x7ff627666f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 1, "id": 1626 }, { "timestamp": "2026-05-28 23:34:58,849", "thread_id": "6052", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc33c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x4574f454d" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1627 }, { "timestamp": "2026-05-28 23:34:58,849", "thread_id": "5144", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 1628 }, { "timestamp": "2026-05-28 23:34:59,381", "thread_id": "5816", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0efc7000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1629 }, { "timestamp": "2026-05-28 23:34:59,381", "thread_id": "5816", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0efc4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1630 }, { "timestamp": "2026-05-28 23:34:59,381", "thread_id": "5816", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08813000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1631 }, { "timestamp": "2026-05-28 23:34:59,381", "thread_id": "5816", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0881b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1632 }, { "timestamp": "2026-05-28 23:34:59,381", "thread_id": "5816", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d28c000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1633 }, { "timestamp": "2026-05-28 23:34:59,381", "thread_id": "5816", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0885c000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1634 }, { "timestamp": "2026-05-28 23:34:59,396", "thread_id": "5020", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc71f6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028fc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1635 }, { "timestamp": "2026-05-28 23:34:59,412", "thread_id": "5140", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002934" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\SystemApps\\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\\resources.pri" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1636 }, { "timestamp": "2026-05-28 23:34:59,412", "thread_id": "5140", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000634" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092b0000" }, { "name": "SectionOffset", "value": "0x0a31e720" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1637 }, { "timestamp": "2026-05-28 23:34:59,412", "thread_id": "5140", "caller": "0x7ffbc544fcb5", "parentcaller": "0x7ffbc544facc", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002934" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\SystemApps\\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\\pris\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1638 }, { "timestamp": "2026-05-28 23:34:59,412", "thread_id": "5140", "caller": "0x7ffbc544fcb5", "parentcaller": "0x7ffbc544facc", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002934" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\SystemApps\\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1639 }, { "timestamp": "2026-05-28 23:34:59,412", "thread_id": "5140", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002934" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\rescache\\_merged\\92721896\\3889361505.pri" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1640 }, { "timestamp": "2026-05-28 23:34:59,412", "thread_id": "5140", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000634" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09350000" }, { "name": "SectionOffset", "value": "0x0a31e5e0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1641 }, { "timestamp": "2026-05-28 23:34:59,412", "thread_id": "5140", "caller": "0x7ffbc544fcb5", "parentcaller": "0x7ffbc544facc", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002408" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\SystemApps\\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\\pris\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1642 }, { "timestamp": "2026-05-28 23:34:59,412", "thread_id": "5140", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002aec" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\SystemApps\\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\\pris\\resources.en-US.pri" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1643 }, { "timestamp": "2026-05-28 23:34:59,412", "thread_id": "3100", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b76068", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f347000" }, { "name": "RegionSize", "value": "0x000c7000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1644 }, { "timestamp": "2026-05-28 23:34:59,412", "thread_id": "3100", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b764ab", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f4d8000" }, { "name": "RegionSize", "value": "0x0004d000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1645 }, { "timestamp": "2026-05-28 23:34:59,412", "thread_id": "3100", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b764ab", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f184000" }, { "name": "RegionSize", "value": "0x0000a000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1646 }, { "timestamp": "2026-05-28 23:34:59,412", "thread_id": "3100", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b76068", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ea9a000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1647 }, { "timestamp": "2026-05-28 23:34:59,412", "thread_id": "3100", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b764ab", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0ea86000" }, { "name": "RegionSize", "value": "0x0000e000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1648 }, { "timestamp": "2026-05-28 23:34:59,412", "thread_id": "3100", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc3af9e56", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "gdi32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc6d10000" } ], "repeated": 0, "id": 1649 }, { "timestamp": "2026-05-28 23:34:59,412", "thread_id": "3100", "caller": "0x7ffbc1ecbbad", "parentcaller": "0x7ffbc1ecbb34", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092c0000" }, { "name": "RegionSize", "value": "0x00004000" } ], "repeated": 0, "id": 1650 }, { "timestamp": "2026-05-28 23:34:59,412", "thread_id": "4832", "caller": "0x7ffbc5d7c304", "parentcaller": "0x7ffbb17112c7", "category": "windows", "api": "SendNotifyMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000100b2" }, { "name": "Message", "value": "0x00000403" } ], "repeated": 0, "id": 1651 }, { "timestamp": "2026-05-28 23:34:59,412", "thread_id": "4864", "caller": "0x7ff62767b46c", "parentcaller": "0x7ff627849fd3", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 1652 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000d74" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000022cc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1653 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022cc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1654 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000d74" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000d74" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1655 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000207c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000d74" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1656 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000d74" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1657 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000207c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000207c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1658 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000b84" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000207c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1659 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000207c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1660 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000b84" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000b84" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1661 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f28" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000b84" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1662 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000b84" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1663 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f28" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f28" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1664 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000020a8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f28" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1665 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001f28" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1666 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000020a8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000020a8" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1667 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f2c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000020a8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1668 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000020a8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1669 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f2c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f2c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1670 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f4c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f2c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1671 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001f2c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1672 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f4c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f4c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1673 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002888" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001f4c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1674 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001f4c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1675 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002888" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002888" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1676 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000288c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002888" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1677 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002888" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1678 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000288c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000288c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1679 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002894" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000288c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1680 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000288c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1681 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002894" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002894" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1682 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002944" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002894" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1683 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002894" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1684 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002944" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002944" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1685 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002b00" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002944" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1686 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002944" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1687 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002b00" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002b00" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1688 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002afc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002b00" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1689 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002b00" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1690 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002afc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002afc" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1691 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002864" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002afc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1692 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002afc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1693 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002864" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002864" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1694 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a68" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002864" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1695 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002864" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1696 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002a68" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a68" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1697 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029f8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002a68" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1698 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a68" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1699 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000029f8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029f8" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1700 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000298c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000029f8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1701 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000029f8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1702 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000298c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000298c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1703 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000297c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000298c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1704 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000298c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff1d0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1705 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000297c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000297c" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1706 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002adc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000297c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1707 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000297c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1708 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002adc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002adc" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1709 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ae0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002adc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1710 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002adc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x079e0000" }, { "name": "SectionOffset", "value": "0x073ff230" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1711 }, { "timestamp": "2026-05-28 23:34:59,631", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002ae0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ae0" }, { "name": "Options", "value": "0x00000003" } ], "repeated": 0, "id": 1712 }, { "timestamp": "2026-05-28 23:34:59,912", "thread_id": "2404", "caller": "0x7ff627679d60", "parentcaller": "0x7ff627679c74", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 1713 }, { "timestamp": "2026-05-28 23:35:00,037", "thread_id": "5044", "caller": "0x7ffbaf96e842", "parentcaller": "0x7ffbaf96d88a", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002644" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1714 }, { "timestamp": "2026-05-28 23:35:00,068", "thread_id": "2404", "caller": "0x7ff627679d60", "parentcaller": "0x7ff627679c74", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 1715 }, { "timestamp": "2026-05-28 23:35:00,068", "thread_id": "5044", "caller": "0x7ffbaf96d59f", "parentcaller": "0x7ffbaf9ac80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002328" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1716 }, { "timestamp": "2026-05-28 23:35:00,068", "thread_id": "5044", "caller": "0x7ffbaf96e842", "parentcaller": "0x7ffbaf96d62c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f2c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1717 }, { "timestamp": "2026-05-28 23:35:00,084", "thread_id": "4864", "caller": "0x7ff62767a0c1", "parentcaller": "0x7ff627666f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 1718 }, { "timestamp": "2026-05-28 23:35:00,084", "thread_id": "6052", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc33c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x4574f454d" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1719 }, { "timestamp": "2026-05-28 23:35:00,084", "thread_id": "4828", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 21, "id": 1720 }, { "timestamp": "2026-05-28 23:35:00,584", "thread_id": "4944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc5c2f034", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000234c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002864" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1721 }, { "timestamp": "2026-05-28 23:35:00,584", "thread_id": "4944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002864" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07c10000" }, { "name": "SectionOffset", "value": "0x073ff170" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1722 }, { "timestamp": "2026-05-28 23:35:00,646", "thread_id": "4864", "caller": "0x7ff62767b354", "parentcaller": "0x7ff62767b12e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 2, "id": 1723 }, { "timestamp": "2026-05-28 23:35:00,646", "thread_id": "5044", "caller": "0x7ffbaf96d59f", "parentcaller": "0x7ffbaf9ac80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002864" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1724 }, { "timestamp": "2026-05-28 23:35:00,662", "thread_id": "4864", "caller": "0x7ff62767a0c1", "parentcaller": "0x7ff627666f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 1725 }, { "timestamp": "2026-05-28 23:35:00,662", "thread_id": "5044", "caller": "0x7ffbaf96d59f", "parentcaller": "0x7ffbaf9ac80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f2c" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1726 }, { "timestamp": "2026-05-28 23:35:00,662", "thread_id": "5044", "caller": "0x7ffbaf96e842", "parentcaller": "0x7ffbaf96d62c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002b00" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1727 }, { "timestamp": "2026-05-28 23:35:00,662", "thread_id": "4864", "caller": "0x7ff62767a0c1", "parentcaller": "0x7ff627666f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 1728 }, { "timestamp": "2026-05-28 23:35:00,662", "thread_id": "5044", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d9af000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1729 }, { "timestamp": "2026-05-28 23:35:00,693", "thread_id": "4864", "caller": "0x7ff62767a0c1", "parentcaller": "0x7ff627666f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 11, "id": 1730 }, { "timestamp": "2026-05-28 23:35:01,099", "thread_id": "4864", "caller": "0x7ff62765652c", "parentcaller": "0x7ff627655d54", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7ffbc4230000" } ], "repeated": 1, "id": 1731 }, { "timestamp": "2026-05-28 23:35:01,099", "thread_id": "4864", "caller": "0x7ff6276623a8", "parentcaller": "0x7ff627662e19", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022d0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\SecurityHealthSSO.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1732 }, { "timestamp": "2026-05-28 23:35:01,099", "thread_id": "4864", "caller": "0x7ff6276623a8", "parentcaller": "0x7ff627662e19", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002644" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08f20000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000eb000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1733 }, { "timestamp": "2026-05-28 23:35:01,099", "thread_id": "4864", "caller": "0x7ff6276623a8", "parentcaller": "0x7ff627662e19", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08f20000" }, { "name": "RegionSize", "value": "0x000eb000" } ], "repeated": 0, "id": 1734 }, { "timestamp": "2026-05-28 23:35:02,256", "thread_id": "2404", "caller": "0x7ff627679d60", "parentcaller": "0x7ff627679c74", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 1735 }, { "timestamp": "2026-05-28 23:35:02,256", "thread_id": "5044", "caller": "0x7ffbaf96d59f", "parentcaller": "0x7ffbaf9ac80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002b00" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1736 }, { "timestamp": "2026-05-28 23:35:02,256", "thread_id": "5044", "caller": "0x7ffbaf96e842", "parentcaller": "0x7ffbaf96d62c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002afc" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1737 }, { "timestamp": "2026-05-28 23:35:02,256", "thread_id": "6052", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc33c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x4574f454d" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1738 }, { "timestamp": "2026-05-28 23:35:02,256", "thread_id": "5144", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 23, "id": 1739 }, { "timestamp": "2026-05-28 23:35:03,427", "thread_id": "5856", "caller": "0x7ffbaf96e842", "parentcaller": "0x7ffbc7bc16e9", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021b0" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1740 }, { "timestamp": "2026-05-28 23:35:04,209", "thread_id": "4864", "caller": "0x7ff627844e81", "parentcaller": "0x7ff62787345c", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x000021b0", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffbc5c4be80" }, { "name": "Parameter", "value": "0x031aee40" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "8988" }, { "name": "ProcessId", "value": "4692" } ], "repeated": 0, "id": 1741 }, { "timestamp": "2026-05-28 23:35:04,209", "thread_id": "8988", "caller": "0x7ff627895dec", "parentcaller": "0x7ff627895f5c", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002358" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1742 }, { "timestamp": "2026-05-28 23:35:04,224", "thread_id": "8988", "caller": "0x7ff62783a3e4", "parentcaller": "0x7ff627849b7a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\twext" }, { "name": "DllBase", "value": "0x7ffbaf610000" } ], "repeated": 0, "id": 1743 }, { "timestamp": "2026-05-28 23:35:04,224", "thread_id": "8988", "caller": "0x7ff62783a3e4", "parentcaller": "0x7ff627849b7a", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "comctl32.dll" }, { "name": "BaseAddress", "value": "0x7ffbb1750000" } ], "repeated": 0, "id": 1744 }, { "timestamp": "2026-05-28 23:35:04,224", "thread_id": "8988", "caller": "0x7ff62783a3e4", "parentcaller": "0x7ff627849b7a", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\twext.dll" }, { "name": "BaseAddress", "value": "0x7ffbaf610000" } ], "repeated": 0, "id": 1745 }, { "timestamp": "2026-05-28 23:35:04,240", "thread_id": "8988", "caller": "0x7ff62783a3e4", "parentcaller": "0x7ff627849b7a", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 1746 }, { "timestamp": "2026-05-28 23:35:04,240", "thread_id": "5856", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f1ad000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1747 }, { "timestamp": "2026-05-28 23:35:04,240", "thread_id": "5856", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f1ee000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1748 }, { "timestamp": "2026-05-28 23:35:04,240", "thread_id": "5856", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08b3c000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1749 }, { "timestamp": "2026-05-28 23:35:04,240", "thread_id": "5856", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08813000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1750 }, { "timestamp": "2026-05-28 23:35:04,240", "thread_id": "5856", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d8ae000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1751 }, { "timestamp": "2026-05-28 23:35:04,240", "thread_id": "5856", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f20f000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1752 }, { "timestamp": "2026-05-28 23:35:04,240", "thread_id": "5856", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b76068", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f051000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1753 }, { "timestamp": "2026-05-28 23:35:04,240", "thread_id": "5044", "caller": "0x7ffbaf96d59f", "parentcaller": "0x7ffbaf9ac80c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002afc" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1754 }, { "timestamp": "2026-05-28 23:35:04,240", "thread_id": "5856", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b76068", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0e9c8000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1755 }, { "timestamp": "2026-05-28 23:35:04,240", "thread_id": "5044", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f28" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1756 }, { "timestamp": "2026-05-28 23:35:04,240", "thread_id": "8988", "caller": "0x7ff62783a3e4", "parentcaller": "0x7ff627849b7a", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 1, "id": 1757 }, { "timestamp": "2026-05-28 23:35:04,256", "thread_id": "5856", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d28c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1758 }, { "timestamp": "2026-05-28 23:35:04,256", "thread_id": "5856", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0881b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1759 }, { "timestamp": "2026-05-28 23:35:04,256", "thread_id": "5856", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0efc4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1760 }, { "timestamp": "2026-05-28 23:35:04,256", "thread_id": "4696", "caller": "0x7ff62762c161", "parentcaller": "0x7ff6276b3e46", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00002178", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffbc5c4be80" }, { "name": "Parameter", "value": "0x0097e0f0" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "8944" }, { "name": "ProcessId", "value": "4692" } ], "repeated": 0, "id": 1761 }, { "timestamp": "2026-05-28 23:35:04,256", "thread_id": "8944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc703ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002530" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1762 }, { "timestamp": "2026-05-28 23:35:04,256", "thread_id": "8988", "caller": "0x7ff62783a3e4", "parentcaller": "0x7ff627849b7a", "category": "process", "api": "ShellExecuteExW", "status": true, "return": "0x00000001", "arguments": [ { "name": "FilePath", "value": "" }, { "name": "Parameters", "value": "" }, { "name": "Show", "value": "1", "pretty_value": "SW_SHOWNORMAL" } ], "repeated": 0, "id": 1763 }, { "timestamp": "2026-05-28 23:35:04,256", "thread_id": "8988", "caller": "0x7ffbc7bd290d", "parentcaller": "0x7ffbc7b635db", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07c10000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 1764 }, { "timestamp": "2026-05-28 23:35:04,256", "thread_id": "8988", "caller": "0x7ffbc7bd290d", "parentcaller": "0x7ffbc7b635db", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\twext" }, { "name": "DllBase", "value": "0x7ffbaf610000" } ], "repeated": 0, "id": 1765 }, { "timestamp": "2026-05-28 23:35:04,256", "thread_id": "8988", "caller": "0x7ffbc7bba871", "parentcaller": "0x7ffbc7bba57f", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08ce0000" }, { "name": "RegionSize", "value": "0x00002000" } ], "repeated": 0, "id": 1766 }, { "timestamp": "2026-05-28 23:35:04,256", "thread_id": "8988", "caller": "0x7ffbc7bc0db0", "parentcaller": "0x7ffbc7b80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbaf610000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1767 }, { "timestamp": "2026-05-28 23:35:04,256", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021bc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1768 }, { "timestamp": "2026-05-28 23:35:04,256", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6c349", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021bc" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1769 }, { "timestamp": "2026-05-28 23:35:04,256", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b3a6", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021bc" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x08\\x01\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1770 }, { "timestamp": "2026-05-28 23:35:04,256", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b477", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021bc" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1771 }, { "timestamp": "2026-05-28 23:35:04,256", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b649", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021bc" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1772 }, { "timestamp": "2026-05-28 23:35:04,256", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021bc" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1773 }, { "timestamp": "2026-05-28 23:35:04,256", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021bc" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1774 }, { "timestamp": "2026-05-28 23:35:04,256", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021bc" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "@\\x03t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1775 }, { "timestamp": "2026-05-28 23:35:04,256", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021bc" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1776 }, { "timestamp": "2026-05-28 23:35:04,256", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021bc" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1777 }, { "timestamp": "2026-05-28 23:35:04,256", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021bc" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "0\\x03t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1778 }, { "timestamp": "2026-05-28 23:35:04,256", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021bc" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1779 }, { "timestamp": "2026-05-28 23:35:04,256", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021bc" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1780 }, { "timestamp": "2026-05-28 23:35:04,256", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021bc" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "H\\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1781 }, { "timestamp": "2026-05-28 23:35:04,256", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b8c3", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021bc" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "X\\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1782 }, { "timestamp": "2026-05-28 23:35:04,256", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021bc" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1783 }, { "timestamp": "2026-05-28 23:35:04,271", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021bc" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa8\\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1784 }, { "timestamp": "2026-05-28 23:35:04,271", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021bc" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1785 }, { "timestamp": "2026-05-28 23:35:04,271", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b585", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021bc" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1786 }, { "timestamp": "2026-05-28 23:35:04,271", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000264c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07c10000" }, { "name": "SectionOffset", "value": "0x0901cbd0" }, { "name": "ViewSize", "value": "0x0000d000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1787 }, { "timestamp": "2026-05-28 23:35:04,271", "thread_id": "8944", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08816000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1788 }, { "timestamp": "2026-05-28 23:35:04,271", "thread_id": "5860", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022d0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1789 }, { "timestamp": "2026-05-28 23:35:04,271", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6c349", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022d0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1790 }, { "timestamp": "2026-05-28 23:35:04,271", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b3a6", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022d0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x08\\x01\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1791 }, { "timestamp": "2026-05-28 23:35:04,271", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b477", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022d0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1792 }, { "timestamp": "2026-05-28 23:35:04,271", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b649", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022d0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1793 }, { "timestamp": "2026-05-28 23:35:04,271", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022d0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1794 }, { "timestamp": "2026-05-28 23:35:04,271", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022d0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1795 }, { "timestamp": "2026-05-28 23:35:04,271", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022d0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "@\\x03t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1796 }, { "timestamp": "2026-05-28 23:35:04,271", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022d0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1797 }, { "timestamp": "2026-05-28 23:35:04,271", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022d0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1798 }, { "timestamp": "2026-05-28 23:35:04,271", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022d0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "0\\x03t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1799 }, { "timestamp": "2026-05-28 23:35:04,271", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022d0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1800 }, { "timestamp": "2026-05-28 23:35:04,271", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022d0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1801 }, { "timestamp": "2026-05-28 23:35:04,271", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022d0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "H\\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1802 }, { "timestamp": "2026-05-28 23:35:04,271", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b8c3", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022d0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "X\\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1803 }, { "timestamp": "2026-05-28 23:35:04,271", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022d0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1804 }, { "timestamp": "2026-05-28 23:35:04,271", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022d0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa8\\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1805 }, { "timestamp": "2026-05-28 23:35:04,271", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022d0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1806 }, { "timestamp": "2026-05-28 23:35:04,271", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b585", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022d0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1807 }, { "timestamp": "2026-05-28 23:35:04,271", "thread_id": "5860", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000264c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07c10000" }, { "name": "SectionOffset", "value": "0x0b20dba0" }, { "name": "ViewSize", "value": "0x0000d000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1808 }, { "timestamp": "2026-05-28 23:35:04,271", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002adc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07c10000" }, { "name": "SectionOffset", "value": "0x0901db50" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1809 }, { "timestamp": "2026-05-28 23:35:04,271", "thread_id": "8944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc282a36b", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002644" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1810 }, { "timestamp": "2026-05-28 23:35:04,271", "thread_id": "8944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc2849362", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002570" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1811 }, { "timestamp": "2026-05-28 23:35:04,271", "thread_id": "8944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc219c2ff", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002334" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1812 }, { "timestamp": "2026-05-28 23:35:04,271", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbb6280552", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "comctl32.dll" }, { "name": "BaseAddress", "value": "0x7ffbb1750000" } ], "repeated": 0, "id": 1813 }, { "timestamp": "2026-05-28 23:35:04,271", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc544e6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\duser.dll" }, { "name": "BaseAddress", "value": "0x7ffbb6860000" } ], "repeated": 0, "id": 1814 }, { "timestamp": "2026-05-28 23:35:04,287", "thread_id": "8944", "caller": "0x7ffbc649b8ed", "parentcaller": "0x7ffbc79faefa", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00002b00", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffbc79fafb0" }, { "name": "Parameter", "value": "0x09d01870" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "8908" }, { "name": "ProcessId", "value": "4692" } ], "repeated": 0, "id": 1815 }, { "timestamp": "2026-05-28 23:35:04,287", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc544e6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "user32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc77b0000" } ], "repeated": 0, "id": 1816 }, { "timestamp": "2026-05-28 23:35:04,287", "thread_id": "8944", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f0d8000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1817 }, { "timestamp": "2026-05-28 23:35:04,287", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000021d0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09360000" }, { "name": "SectionOffset", "value": "0x0901e610" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1818 }, { "timestamp": "2026-05-28 23:35:04,287", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002378" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09360000" }, { "name": "SectionOffset", "value": "0x0901e6d0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1819 }, { "timestamp": "2026-05-28 23:35:04,287", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002378" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09360000" }, { "name": "SectionOffset", "value": "0x0901e6d0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1820 }, { "timestamp": "2026-05-28 23:35:04,287", "thread_id": "8944", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f14f000" }, { "name": "RegionSize", "value": "0x0003f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1821 }, { "timestamp": "2026-05-28 23:35:04,287", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbb0acf775", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\MsftEdit" }, { "name": "DllBase", "value": "0x7ffbaa9a0000" } ], "repeated": 0, "id": 1822 }, { "timestamp": "2026-05-28 23:35:04,287", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbb0acf775", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "MsftEdit.dll" }, { "name": "BaseAddress", "value": "0x7ffbaa9a0000" } ], "repeated": 0, "id": 1823 }, { "timestamp": "2026-05-28 23:35:04,287", "thread_id": "8944", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0edad000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1824 }, { "timestamp": "2026-05-28 23:35:04,302", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbaa9b9673", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ole32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc7560000" } ], "repeated": 0, "id": 1825 }, { "timestamp": "2026-05-28 23:35:04,302", "thread_id": "8944", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f2a5000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1826 }, { "timestamp": "2026-05-28 23:35:04,302", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf" }, { "name": "DllBase", "value": "0x7ffb6d450000" } ], "repeated": 0, "id": 1827 }, { "timestamp": "2026-05-28 23:35:04,302", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll" }, { "name": "BaseAddress", "value": "0x7ffb6d450000" } ], "repeated": 0, "id": 1828 }, { "timestamp": "2026-05-28 23:35:04,302", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002308" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09360000" }, { "name": "SectionOffset", "value": "0x0901eef0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1829 }, { "timestamp": "2026-05-28 23:35:04,302", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000232c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09360000" }, { "name": "SectionOffset", "value": "0x0901efb0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1830 }, { "timestamp": "2026-05-28 23:35:04,302", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000232c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09360000" }, { "name": "SectionOffset", "value": "0x0901efb0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1831 }, { "timestamp": "2026-05-28 23:35:04,302", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002548" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09360000" }, { "name": "SectionOffset", "value": "0x0901f1d0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1832 }, { "timestamp": "2026-05-28 23:35:04,302", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002548" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09360000" }, { "name": "SectionOffset", "value": "0x0901f0a0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1833 }, { "timestamp": "2026-05-28 23:35:04,302", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002548" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09360000" }, { "name": "SectionOffset", "value": "0x0901f0a0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1834 }, { "timestamp": "2026-05-28 23:35:04,302", "thread_id": "5856", "caller": "0x7ffbc77d93d7", "parentcaller": "0x7ffbc4fe1e7e", "category": "windows", "api": "SendNotifyMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x0004048a" }, { "name": "Message", "value": "0x00000218" } ], "repeated": 0, "id": 1835 }, { "timestamp": "2026-05-28 23:35:04,302", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002454" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09360000" }, { "name": "SectionOffset", "value": "0x0901e330" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1836 }, { "timestamp": "2026-05-28 23:35:04,302", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000026ac" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09360000" }, { "name": "SectionOffset", "value": "0x0901e3f0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1837 }, { "timestamp": "2026-05-28 23:35:04,302", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000026ac" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09360000" }, { "name": "SectionOffset", "value": "0x0901e3f0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1838 }, { "timestamp": "2026-05-28 23:35:04,302", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000026a4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09360000" }, { "name": "SectionOffset", "value": "0x0901d390" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1839 }, { "timestamp": "2026-05-28 23:35:04,302", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022c8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09360000" }, { "name": "SectionOffset", "value": "0x0901d450" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1840 }, { "timestamp": "2026-05-28 23:35:04,302", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022c8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09360000" }, { "name": "SectionOffset", "value": "0x0901d450" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1841 }, { "timestamp": "2026-05-28 23:35:04,302", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 1842 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\UIRibbon" }, { "name": "DllBase", "value": "0x7ffb6d060000" } ], "repeated": 0, "id": 1843 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\UIRibbon.dll" }, { "name": "BaseAddress", "value": "0x7ffb6d060000" } ], "repeated": 0, "id": 1844 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000255c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\UIRibbonRes.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1845 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffbc5457786", "parentcaller": "0x7ffbc5455630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x00002304" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09570000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000ce000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1846 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffbc7b5ac40", "parentcaller": "0x7ffbc54954d8", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09640000" }, { "name": "RegionSize", "value": "0x00030000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1847 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffbc7b5acf2", "parentcaller": "0x7ffbc54954d8", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09660000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1848 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09662000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1849 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc544e6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "atlthunk.dll" }, { "name": "BaseAddress", "value": "0x7ffbaa3d0000" } ], "repeated": 0, "id": 1850 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffb6d07334f", "parentcaller": "0x7ffb6d074056", "category": "system", "api": "SetWindowsHookExW", "status": true, "return": "0x000a03fb", "arguments": [ { "name": "HookIdentifier", "value": "3", "pretty_value": "WH_GETMESSAGE" }, { "name": "ProcedureAddress", "value": "0x7ffb6d073400" }, { "name": "ModuleAddress", "value": "0x7ffb6d060000" }, { "name": "ThreadId", "value": "8944" } ], "repeated": 0, "id": 1851 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffb6d073381", "parentcaller": "0x7ffb6d074056", "category": "system", "api": "SetWindowsHookExW", "status": true, "return": "0x000204cb", "arguments": [ { "name": "HookIdentifier", "value": "4", "pretty_value": "WH_CALLWNDPROC" }, { "name": "ProcedureAddress", "value": "0x7ffb6d073620" }, { "name": "ModuleAddress", "value": "0x7ffb6d060000" }, { "name": "ThreadId", "value": "8944" } ], "repeated": 0, "id": 1852 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc77d2b57", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\UIRibbon.dll" }, { "name": "BaseAddress", "value": "0x7ffb6d060000" } ], "repeated": 0, "id": 1853 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffb6d09a34d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "Comctl32.dll" }, { "name": "BaseAddress", "value": "0x7ffbb1750000" } ], "repeated": 0, "id": 1854 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f109000" }, { "name": "RegionSize", "value": "0x00006000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1855 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f0ad000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1856 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d60e000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1857 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09665000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1858 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09666000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1859 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09667000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1860 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09668000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1861 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09669000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1862 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0966a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1863 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0966b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1864 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0966c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1865 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0966d000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1866 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffbc7b5e46f", "parentcaller": "0x7ffbc7b7dbfa", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09730000" }, { "name": "RegionSize", "value": "0x00100000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1867 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffbc7b5e4f0", "parentcaller": "0x7ffbc7b7dbfa", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09730000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1868 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09732000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1869 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09733000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1870 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09734000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1871 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09735000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1872 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffbc7b9bb2a", "parentcaller": "0x7ffbc7b9b99e", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002104" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\UIRibbon.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1873 }, { "timestamp": "2026-05-28 23:35:04,318", "thread_id": "8944", "caller": "0x7ffbc7b9bbcc", "parentcaller": "0x7ffbc7b9b99e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002100" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09390000" }, { "name": "SectionOffset", "value": "0x0901c310" }, { "name": "ViewSize", "value": "0x00005000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1874 }, { "timestamp": "2026-05-28 23:35:04,334", "thread_id": "8944", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffb6d0d8931", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09640000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1875 }, { "timestamp": "2026-05-28 23:35:04,334", "thread_id": "8944", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffb6d0d87fb", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09640000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1876 }, { "timestamp": "2026-05-28 23:35:04,334", "thread_id": "8944", "caller": "0x313d6819b37", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f05e000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1877 }, { "timestamp": "2026-05-28 23:35:04,334", "thread_id": "8944", "caller": "0x313d6819907", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 4, "id": 1878 }, { "timestamp": "2026-05-28 23:35:04,334", "thread_id": "8944", "caller": "0x313d6819bf7", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f0e5000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1879 }, { "timestamp": "2026-05-28 23:35:04,334", "thread_id": "8944", "caller": "0x313d6819e27", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "Ntdll.dll" }, { "name": "BaseAddress", "value": "0x7ffbc7b50000" } ], "repeated": 0, "id": 1880 }, { "timestamp": "2026-05-28 23:35:04,334", "thread_id": "8944", "caller": "0x313d6819597", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f099000" }, { "name": "RegionSize", "value": "0x0000d000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1881 }, { "timestamp": "2026-05-28 23:35:04,334", "thread_id": "8944", "caller": "0x313d68187f7", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\SystemResources\\UIRibbon.dll.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1882 }, { "timestamp": "2026-05-28 23:35:04,334", "thread_id": "8944", "caller": "0x313d68197c7", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09736000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1883 }, { "timestamp": "2026-05-28 23:35:04,349", "thread_id": "8944", "caller": "0x313d6818e77", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\uiautomationcore.dll" }, { "name": "BaseAddress", "value": "0x7ffbabdd0000" } ], "repeated": 0, "id": 1884 }, { "timestamp": "2026-05-28 23:35:04,349", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbb6280552", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "UIAutomationCore.dll" }, { "name": "BaseAddress", "value": "0x7ffbabdd0000" } ], "repeated": 0, "id": 1885 }, { "timestamp": "2026-05-28 23:35:04,349", "thread_id": "8944", "caller": "0x313d681b6d7", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000212c" }, { "name": "DesiredAccess", "value": "0x00100020", "pretty_value": "FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1886 }, { "timestamp": "2026-05-28 23:35:04,349", "thread_id": "8944", "caller": "0x313d681bb67", "parentcaller": "0x00000000", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x000024f8", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffbc7272d30" }, { "name": "Parameter", "value": "0x0eac6c20" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "8884" }, { "name": "ProcessId", "value": "4692" } ], "repeated": 0, "id": 1887 }, { "timestamp": "2026-05-28 23:35:04,349", "thread_id": "8884", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc703ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001a28" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1888 }, { "timestamp": "2026-05-28 23:35:04,349", "thread_id": "8884", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "BaseAddress", "value": "0x7ffbabdd0000" } ], "repeated": 0, "id": 1889 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "8944", "caller": "0x313d6815b87", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002340" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\UIAutomationCore.DLL.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1890 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "8944", "caller": "0x313d6815b87", "parentcaller": "0x00000000", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002920" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dab0000" }, { "name": "SectionOffset", "value": "0x09017810" }, { "name": "ViewSize", "value": "0x00005000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1891 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024d4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dac0000" }, { "name": "SectionOffset", "value": "0x0901b1f0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1892 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024d4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dac0000" }, { "name": "SectionOffset", "value": "0x0901d060" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 1893 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "5020", "caller": "0x7ffbc649b8ed", "parentcaller": "0x7ffbc5c46d18", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x0000249c", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffbc5c4be80" }, { "name": "Parameter", "value": "0x07c0ef70" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "9036" }, { "name": "ProcessId", "value": "4692" } ], "repeated": 0, "id": 1894 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "9036", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc33c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000030" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1895 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "9036", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc33c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x7ffbc33652a2" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1896 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "9036", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1897 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1898 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1899 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1900 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1901 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "@\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1902 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1903 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 1904 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x04\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1905 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002920" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dac0000" }, { "name": "SectionOffset", "value": "0x0901d050" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1906 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000029f8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dac0000" }, { "name": "SectionOffset", "value": "0x0901d110" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1907 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000029f8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0dac0000" }, { "name": "SectionOffset", "value": "0x0901d110" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1908 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "L\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1909 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "N\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1910 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xdf\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1911 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe3\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1912 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "3\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1913 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "7\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1914 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x93\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1915 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x97\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1916 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x05\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1917 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "9036", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc33c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000030" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1918 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "9036", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1919 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 1920 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1921 }, { "timestamp": "2026-05-28 23:35:04,365", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1922 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1923 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1924 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x11\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1925 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc0\\x16\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1926 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024d4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092b0000" }, { "name": "SectionOffset", "value": "0x0901db50" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1927 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022e8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092b0000" }, { "name": "SectionOffset", "value": "0x0901dc10" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1928 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022e8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092b0000" }, { "name": "SectionOffset", "value": "0x0901dc10" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1929 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "@\\x19\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1930 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1931 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 1932 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x04\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1933 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000998" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\resources\\Themes\\aero\\Shell\\NormalColor\\ShellStyle.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1934 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc5457906", "parentcaller": "0x7ffbc5455630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000e44" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000f3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1935 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc544ad9e", "parentcaller": "0x7ffbc5dcd72b", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "RegionSize", "value": "0x000f3000" } ], "repeated": 0, "id": 1936 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "L\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1937 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "N\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1938 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000e44" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\resources\\Themes\\aero\\Shell\\NormalColor\\ShellStyle.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1939 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc5457906", "parentcaller": "0x7ffbc5455630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000998" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000f3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1940 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x9e\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1941 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbb627f40a", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\xmllite.dll" }, { "name": "BaseAddress", "value": "0x7ffbc0d70000" } ], "repeated": 0, "id": 1942 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa2\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1943 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe3\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1944 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe7\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1945 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "C\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1946 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "G\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1947 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "@\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1948 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "u\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1949 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1950 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x84\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1951 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc544ad9e", "parentcaller": "0x7ffbc5dcd589", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "RegionSize", "value": "0x000f3000" } ], "repeated": 0, "id": 1952 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xcc\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1953 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xce\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1954 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 2, "id": 1955 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x1e\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1956 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\"\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1957 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "e\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1958 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "i\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1959 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc5\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1960 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc9\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1961 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "7\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1962 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1963 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x84\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1964 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xcc\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1965 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xce\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1966 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000998" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\resources\\Themes\\aero\\Shell\\NormalColor\\ShellStyle.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1967 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc5457906", "parentcaller": "0x7ffbc5455630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000e44" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000f3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1968 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbb627f40a", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\xmllite.dll" }, { "name": "BaseAddress", "value": "0x7ffbc0d70000" } ], "repeated": 0, "id": 1969 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc544ad9e", "parentcaller": "0x7ffbc5df2fa9", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "RegionSize", "value": "0x000f3000" } ], "repeated": 0, "id": 1970 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\"\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1971 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000e44" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\resources\\Themes\\aero\\Shell\\NormalColor\\ShellStyle.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1972 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc5457906", "parentcaller": "0x7ffbc5455630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000998" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000f3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1973 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc544ad9e", "parentcaller": "0x7ffbc5de6a1e", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "RegionSize", "value": "0x000f3000" } ], "repeated": 0, "id": 1974 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "i\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1975 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000998" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\resources\\Themes\\aero\\Shell\\NormalColor\\ShellStyle.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1976 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc5457906", "parentcaller": "0x7ffbc5455630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000e44" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000f3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1977 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc544ad9e", "parentcaller": "0x7ffbc5de6a1e", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "RegionSize", "value": "0x000f3000" } ], "repeated": 0, "id": 1978 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc5\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1979 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc9\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1980 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000e44" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\resources\\Themes\\aero\\Shell\\NormalColor\\ShellStyle.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1981 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc5457906", "parentcaller": "0x7ffbc5455630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000998" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000f3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1982 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "D\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1983 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc544ad9e", "parentcaller": "0x7ffbc5de6a1e", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "RegionSize", "value": "0x000f3000" } ], "repeated": 0, "id": 1984 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x8c\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1985 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000998" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\resources\\Themes\\aero\\Shell\\NormalColor\\ShellStyle.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1986 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc5457906", "parentcaller": "0x7ffbc5455630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000e44" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000f3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1987 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc544ad9e", "parentcaller": "0x7ffbc5de6a1e", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "RegionSize", "value": "0x000f3000" } ], "repeated": 0, "id": 1988 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000e44" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\resources\\Themes\\aero\\Shell\\NormalColor\\ShellStyle.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1989 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc5457906", "parentcaller": "0x7ffbc5455630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000998" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000f3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1990 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc544ad9e", "parentcaller": "0x7ffbc5de6a1e", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "RegionSize", "value": "0x000f3000" } ], "repeated": 0, "id": 1991 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe2\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1992 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1993 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "$\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1994 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1995 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x84\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1996 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x88\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1997 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c4" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xf6\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1998 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1999 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 2000 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2001 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2002 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2003 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2004 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2005 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000998" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092b0000" }, { "name": "SectionOffset", "value": "0x0901d130" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2006 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000e44" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092b0000" }, { "name": "SectionOffset", "value": "0x0901d1f0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2007 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000e44" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x092b0000" }, { "name": "SectionOffset", "value": "0x0901d1f0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2008 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x04\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2009 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "L\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2010 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002480" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\imageres.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2011 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc5457906", "parentcaller": "0x7ffbc5455630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002464" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0df10000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2012 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "N\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2013 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc7b9bb2a", "parentcaller": "0x7ffbc7b9b99e", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002464" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\SystemResources\\imageres.dll.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2014 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc7b9bbcc", "parentcaller": "0x7ffbc7b9b99e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002480" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x15790000" }, { "name": "SectionOffset", "value": "0x0901c330" }, { "name": "ViewSize", "value": "0x013c0000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2015 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x9e\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2016 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa2\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2017 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc7bba871", "parentcaller": "0x7ffbc544ad69", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x15790000" }, { "name": "RegionSize", "value": "0x013c0000" } ], "repeated": 0, "id": 2018 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc544ad9e", "parentcaller": "0x7ffbc5dbad58", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0df10000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2019 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe1\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2020 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe5\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2021 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002464" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\resources\\Themes\\aero\\Shell\\NormalColor\\ShellStyle.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2022 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc5457906", "parentcaller": "0x7ffbc5455630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002480" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000f3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2023 }, { "timestamp": "2026-05-28 23:35:04,381", "thread_id": "8944", "caller": "0x7ffbc544ad9e", "parentcaller": "0x7ffbc5de6a1e", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "RegionSize", "value": "0x000f3000" } ], "repeated": 0, "id": 2024 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "E\\x16\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2025 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xb3\\x16\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2026 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80\\x17\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2027 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x84\\x17\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2028 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xcc\\x17\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2029 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xce\\x17\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2030 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x1e\\x18\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2031 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\"\\x18\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2032 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001b4c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\resources\\Themes\\aero\\Shell\\NormalColor\\ShellStyle.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2033 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "8944", "caller": "0x7ffbc5457906", "parentcaller": "0x7ffbc5455630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002878" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000f3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2034 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "b\\x18\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2035 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "8944", "caller": "0x7ffbc544ad9e", "parentcaller": "0x7ffbc5de6a1e", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "RegionSize", "value": "0x000f3000" } ], "repeated": 0, "id": 2036 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002878" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\resources\\Themes\\aero\\Shell\\NormalColor\\ShellStyle.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2037 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "8944", "caller": "0x7ffbc5457906", "parentcaller": "0x7ffbc5455630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001b4c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000f3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2038 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "8944", "caller": "0x7ffbc544ad9e", "parentcaller": "0x7ffbc5de6a1e", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "RegionSize", "value": "0x000f3000" } ], "repeated": 0, "id": 2039 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc2\\x18\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2040 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001b4c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\resources\\Themes\\aero\\Shell\\NormalColor\\ShellStyle.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2041 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "8944", "caller": "0x7ffbc5457906", "parentcaller": "0x7ffbc5455630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002878" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000f3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2042 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "8944", "caller": "0x7ffbc544ad9e", "parentcaller": "0x7ffbc5de6a1e", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "RegionSize", "value": "0x000f3000" } ], "repeated": 0, "id": 2043 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "4\\x19\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2044 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024bc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\resources\\Themes\\aero\\Shell\\NormalColor\\ShellStyle.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2045 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "8944", "caller": "0x7ffbc5457906", "parentcaller": "0x7ffbc5455630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024b8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000f3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2046 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2047 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "8944", "caller": "0x7ffbc544ad9e", "parentcaller": "0x7ffbc5de6a1e", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "RegionSize", "value": "0x000f3000" } ], "repeated": 0, "id": 2048 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x04\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2049 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "L\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2050 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\resources\\Themes\\aero\\Shell\\NormalColor\\ShellStyle.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2051 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "8944", "caller": "0x7ffbc5457906", "parentcaller": "0x7ffbc5455630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024bc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000f3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2052 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "8944", "caller": "0x7ffbc649b8ed", "parentcaller": "0x7ffbb62ca901", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x000024bc", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffbb62caad0" }, { "name": "Parameter", "value": "0x7ffbb63d51c8" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "8888" }, { "name": "ProcessId", "value": "4692" } ], "repeated": 0, "id": 2053 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x9e\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2054 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa2\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2055 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe3\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2056 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe7\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2057 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "C\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2058 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "G\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2059 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "8888", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0e887000" }, { "name": "RegionSize", "value": "0x000c8000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2060 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "8944", "caller": "0x7ffbc544ad9e", "parentcaller": "0x7ffbc5de6a1e", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "RegionSize", "value": "0x000f3000" } ], "repeated": 0, "id": 2061 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "@\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2062 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "u\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2063 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\resources\\Themes\\aero\\Shell\\NormalColor\\ShellStyle.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2064 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "8944", "caller": "0x7ffbc5457906", "parentcaller": "0x7ffbc5455630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000024b0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000f3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2065 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "8944", "caller": "0x7ffbc544ad9e", "parentcaller": "0x7ffbc5de6a1e", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "RegionSize", "value": "0x000f3000" } ], "repeated": 0, "id": 2066 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2067 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x84\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2068 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xcc\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2069 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xce\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2070 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x1e\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2071 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\"\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2072 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "e\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2073 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "i\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2074 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc5\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2075 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc9\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2076 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "7\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2077 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2078 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x84\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2079 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xcc\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2080 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xce\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2081 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x1e\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2082 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001714" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2083 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\"\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2084 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001714" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2085 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "e\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2086 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "i\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2087 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc5\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2088 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc9\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2089 }, { "timestamp": "2026-05-28 23:35:04,396", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "7\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2090 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "@\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2091 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "D\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2092 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002544" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2093 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x8e\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2094 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6c349", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002544" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2095 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xde\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2096 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6c3af", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002544" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2097 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b3a6", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002544" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x08\\x01\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2098 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe2\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2099 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b477", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002544" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2100 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2101 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b649", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002544" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2102 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "$\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2103 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002544" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2104 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2105 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002544" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2106 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x84\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2107 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002544" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "@\\x03t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2108 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x88\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2109 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002544" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2110 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "9036", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xf6\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2111 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002544" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2112 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002544" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "0\\x03t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2113 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002544" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2114 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002544" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 2115 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002544" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "H\\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2116 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b8c3", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002544" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "X\\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2117 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002544" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 2118 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002544" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa8\\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2119 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002544" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2120 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b585", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002544" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2121 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002510" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0df10000" }, { "name": "SectionOffset", "value": "0x0901b600" }, { "name": "ViewSize", "value": "0x0000d000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2122 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "5860", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021b0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2123 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6c349", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021b0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 2124 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b3a6", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021b0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x08\\x01\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2125 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b477", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021b0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2126 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b649", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021b0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2127 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021b0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2128 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021b0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2129 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021b0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "@\\x03t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2130 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021b0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2131 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021b0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2132 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021b0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "0\\x03t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2133 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021b0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2134 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021b0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 2135 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021b0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "H\\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2136 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b8c3", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021b0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "X\\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2137 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021b0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 2138 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021b0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa8\\x02t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2139 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021b0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2140 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "5860", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b585", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021b0" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\ieframe.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2141 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "5020", "caller": "0x7ffbc348d4e4", "parentcaller": "0x7ffbc33c3285", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00b44281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2142 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "5860", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000021ec" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0df10000" }, { "name": "SectionOffset", "value": "0x0b20dba0" }, { "name": "ViewSize", "value": "0x0000d000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2143 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "5020", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002460" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Desktop\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2144 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "5020", "caller": "0x7ffbc348d4e4", "parentcaller": "0x7ffbc33c348f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00b44281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2145 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 1, "id": 2146 }, { "timestamp": "2026-05-28 23:35:04,412", "thread_id": "5020", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2147 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5020", "caller": "0x7ffbc348d4e4", "parentcaller": "0x7ffbc33c3285", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00b44281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2148 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5020", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021ec" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Downloads\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2149 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5020", "caller": "0x7ffbc348d4e4", "parentcaller": "0x7ffbc33c348f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00b44281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2150 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5020", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2151 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5020", "caller": "0x7ffbc348d4e4", "parentcaller": "0x7ffbc33c3285", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00b44281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2152 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5020", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021ec" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Documents\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2153 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5020", "caller": "0x7ffbc348d4e4", "parentcaller": "0x7ffbc33c348f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00b44281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2154 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5020", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2155 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 1, "id": 2156 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5020", "caller": "0x7ffbc348d4e4", "parentcaller": "0x7ffbc33c3285", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00b44281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2157 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5020", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021ec" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Pictures\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2158 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5020", "caller": "0x7ffbc348d4e4", "parentcaller": "0x7ffbc33c348f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00b44281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2159 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5020", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2160 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5020", "caller": "0x7ffbc348d4e4", "parentcaller": "0x7ffbc33c3285", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00b44281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2161 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5020", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021ec" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Music\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2162 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5020", "caller": "0x7ffbc348d4e4", "parentcaller": "0x7ffbc33c348f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00b44281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2163 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5020", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2164 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5020", "caller": "0x7ffbc348d4e4", "parentcaller": "0x7ffbc33c3285", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00b44281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2165 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5020", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021ec" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Videos\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2166 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5020", "caller": "0x7ffbc348d4e4", "parentcaller": "0x7ffbc33c348f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00b44281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2167 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5020", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 2168 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 2, "id": 2169 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5856", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc33c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000030" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2170 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5020", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024f8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2171 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5856", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2172 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5020", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024f8" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Public\\Desktop" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2173 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 2174 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2175 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5020", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2176 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2177 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2178 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5020", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2179 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2180 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5020", "caller": "0x7ffbc7b9d2a3", "parentcaller": "0x7ffbc7b6bac7", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x7ffbc7bed2c4" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "::\\" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 2181 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x11\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2182 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5020", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2183 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc0\\x16\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2184 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "@\\x19\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2185 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5020", "caller": "0x7ffbc7b9d2a3", "parentcaller": "0x7ffbc7b6bac7", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x7ffbc7bed2c4" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "::\\" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 2186 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2187 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 1, "id": 2188 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x04\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2189 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5020", "caller": "0x7ffbc348d4e4", "parentcaller": "0x7ffbc33c3285", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00b44281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2190 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5020", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025fc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\OneDrive\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2191 }, { "timestamp": "2026-05-28 23:35:04,427", "thread_id": "5020", "caller": "0x7ffbc348d4e4", "parentcaller": "0x7ffbc33c348f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00b44281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2192 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5020", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2193 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "N\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2194 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x9e\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2195 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5020", "caller": "0x7ffbc5456bcf", "parentcaller": "0x7ffbc5456883", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021ec" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\STORAGE#Volume#{e32a9442-5af2-11f1-ae2c-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 2196 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa2\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2197 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5020", "caller": "0x7ffbc5454d82", "parentcaller": "0x7ffbc54568df", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021ec" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\STORAGE#Volume#{e32a9442-5af2-11f1-ae2c-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 2198 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5020", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5454f8e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021ec" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2199 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5020", "caller": "0x7ffbc5456bcf", "parentcaller": "0x7ffbc5456883", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021ec" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\STORAGE#Volume#{e32a9442-5af2-11f1-ae2c-806e6f6e6963}#0000000003300000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 2200 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5020", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5454f8e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000021ec" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2201 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe7\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2202 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "C\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2203 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "G\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2204 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "@\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2205 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "u\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2206 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2207 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x84\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2208 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xcc\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2209 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xce\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2210 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x1e\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2211 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\"\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2212 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "8944", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2213 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "e\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2214 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "i\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2215 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc5\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2216 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc9\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2217 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "7\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2218 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2219 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x84\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2220 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xcc\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2221 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "4864", "caller": "0x7ff62767b354", "parentcaller": "0x7ff62767b12e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2222 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5852", "caller": "0x7ff62767bdd2", "parentcaller": "0x7ff62767a52a", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b4" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2223 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "2404", "caller": "0x7ff627679d60", "parentcaller": "0x7ff627679c74", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2224 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xce\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2225 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5852", "caller": "0x7ff62767bdd2", "parentcaller": "0x7ff62767a52a", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2226 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\"\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2227 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5852", "caller": "0x7ff62767a552", "parentcaller": "0x7ff627679a4f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 1, "id": 2228 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "e\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2229 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "4828", "caller": "0x7ff62763a878", "parentcaller": "0x7ff62763a7ba", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7180000" }, { "name": "RegionSize", "value": "0x003e3000" } ], "repeated": 0, "id": 2230 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "i\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2231 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc5\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2232 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc9\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2233 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "6052", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc33c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x4574f454d" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2234 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "6052", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2235 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "D\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2236 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2237 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x8c\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2238 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x8e\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2239 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "4864", "caller": "0x7ff62767a0c1", "parentcaller": "0x7ff627666f8c", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2240 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xde\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2241 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe2\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2242 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2243 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "$\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2244 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2245 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x84\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2246 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x88\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2247 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002788" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xf6\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2248 }, { "timestamp": "2026-05-28 23:35:04,443", "thread_id": "5856", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2249 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2250 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2251 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2252 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2253 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2254 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2255 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2256 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2257 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2258 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2259 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2260 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x11\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2261 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2262 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc0\\x16\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2263 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x04\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2264 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "@\\x19\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2265 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2266 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "L\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2267 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "N\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2268 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x84\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2269 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa2\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2270 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xcc\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2271 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xce\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2272 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe1\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2273 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe5\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2274 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x1e\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2275 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "A\\x16\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2276 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\"\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2277 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "E\\x16\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2278 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "e\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2279 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xb3\\x16\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2280 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "i\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2281 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80\\x17\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2282 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc5\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2283 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x84\\x17\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2284 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc9\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2285 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xcc\\x17\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2286 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "7\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2287 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xce\\x17\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2288 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80\\x17\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2289 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x1e\\x18\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2290 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x84\\x17\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2291 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\"\\x18\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2292 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "8944", "caller": "0x313d68187e7", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\OneDrive" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 2293 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "8944", "caller": "0x313d6818997", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002498" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\OneDrive\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2294 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "f\\x18\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2295 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "8944", "caller": "0x313d68187e7", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002498" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\OneDrive" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 2296 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc6\\x18\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2297 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "8944", "caller": "0x313d68184c7", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002498" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\OneDrive\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2298 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "b\\x18\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2299 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "4\\x19\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2300 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "8944", "caller": "0x313d68187e7", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00002498" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 2301 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2302 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "f\\x18\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2303 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "8944", "caller": "0x313d6818997", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002498" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2304 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc2\\x18\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2305 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x04\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2306 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "8944", "caller": "0x313d68187e7", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025cc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 2307 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "L\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2308 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "8944", "caller": "0x313d6818507", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025cc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 2309 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "N\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2310 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "8944", "caller": "0x313d68184c7", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025cc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2311 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "8944", "caller": "0x313d68187e7", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x000025cc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 2312 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2313 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "8944", "caller": "0x313d6818997", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025cc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2314 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa2\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2315 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "8944", "caller": "0x313d68187e7", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025cc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 2316 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "L\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2317 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "8944", "caller": "0x313d68184c7", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025cc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2318 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe7\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2319 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "8944", "caller": "0x313d6818507", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025cc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 2320 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "G\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2321 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "8944", "caller": "0x313d6818697", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025cc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2322 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x9e\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2323 }, { "timestamp": "2026-05-28 23:35:04,459", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "@\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2324 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa2\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2325 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe1\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2326 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe5\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2327 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "u\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2328 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "A\\x16\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2329 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2330 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "8944", "caller": "0x313d68188a7", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2331 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "E\\x16\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2332 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x84\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2333 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xb3\\x16\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2334 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xcc\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2335 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025c0" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\OneDrive" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2336 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "@\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2337 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xce\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2338 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "D\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2339 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x1e\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2340 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025cc" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\OneDrive" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2341 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001714" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\OneDrive" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2342 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xde\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2343 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "i\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2344 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe2\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2345 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc5\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2346 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2347 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc9\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2348 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "$\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2349 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "7\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2350 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2351 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2352 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x84\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2353 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x84\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2354 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x88\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2355 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xcc\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2356 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xf6\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2357 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xce\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2358 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2359 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x1e\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2360 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x04\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2361 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\"\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2362 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "L\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2363 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "e\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2364 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "N\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2365 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "i\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2366 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x9e\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2367 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc5\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2368 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa2\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2369 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc9\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2370 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe3\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2371 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "7\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2372 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe7\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2373 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "@\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2374 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "C\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2375 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "D\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2376 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "G\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2377 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x8c\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2378 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "@\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2379 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x8e\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2380 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xde\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2381 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "u\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2382 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe2\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2383 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2384 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2385 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x84\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2386 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "$\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2387 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xcc\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2388 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2389 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xce\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2390 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x84\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2391 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x1e\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2392 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x88\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2393 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\"\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2394 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024b0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xf6\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2395 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "e\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2396 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "i\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2397 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc5\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2398 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc9\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2399 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "7\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2400 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 4, "id": 2401 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5140", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2402 }, { "timestamp": "2026-05-28 23:35:04,474", "thread_id": "5856", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 20, "id": 2403 }, { "timestamp": "2026-05-28 23:35:04,490", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 3, "id": 2404 }, { "timestamp": "2026-05-28 23:35:04,490", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002658" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\imageres.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2405 }, { "timestamp": "2026-05-28 23:35:04,490", "thread_id": "5020", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2406 }, { "timestamp": "2026-05-28 23:35:04,490", "thread_id": "8944", "caller": "0x7ffbc5457906", "parentcaller": "0x7ffbc5455630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000025a8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2407 }, { "timestamp": "2026-05-28 23:35:04,490", "thread_id": "8944", "caller": "0x313d6819847", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025a8" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\SystemResources\\imageres.dll.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2408 }, { "timestamp": "2026-05-28 23:35:04,490", "thread_id": "8944", "caller": "0x313d6819847", "parentcaller": "0x00000000", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002658" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x15790000" }, { "name": "SectionOffset", "value": "0x0901bbd0" }, { "name": "ViewSize", "value": "0x013c0000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2409 }, { "timestamp": "2026-05-28 23:35:04,490", "thread_id": "8944", "caller": "0x7ffbc7bba871", "parentcaller": "0x7ffbc544ad69", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x15790000" }, { "name": "RegionSize", "value": "0x013c0000" } ], "repeated": 0, "id": 2410 }, { "timestamp": "2026-05-28 23:35:04,490", "thread_id": "8944", "caller": "0x7ffbc544ad9e", "parentcaller": "0x7ffbc60f1922", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2411 }, { "timestamp": "2026-05-28 23:35:04,490", "thread_id": "8944", "caller": "0x313d6819d17", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2412 }, { "timestamp": "2026-05-28 23:35:04,490", "thread_id": "4748", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2413 }, { "timestamp": "2026-05-28 23:35:04,490", "thread_id": "8944", "caller": "0x313d6819d17", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 2414 }, { "timestamp": "2026-05-28 23:35:04,490", "thread_id": "5856", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2415 }, { "timestamp": "2026-05-28 23:35:04,490", "thread_id": "5020", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 2416 }, { "timestamp": "2026-05-28 23:35:04,490", "thread_id": "4748", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2417 }, { "timestamp": "2026-05-28 23:35:04,490", "thread_id": "4748", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 2418 }, { "timestamp": "2026-05-28 23:35:04,506", "thread_id": "8944", "caller": "0x313d6818007", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2419 }, { "timestamp": "2026-05-28 23:35:04,506", "thread_id": "8944", "caller": "0x313d681eb37", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2420 }, { "timestamp": "2026-05-28 23:35:04,506", "thread_id": "5856", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2421 }, { "timestamp": "2026-05-28 23:35:04,506", "thread_id": "5856", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 15, "id": 2422 }, { "timestamp": "2026-05-28 23:35:04,506", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002568" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Downloads" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2423 }, { "timestamp": "2026-05-28 23:35:04,506", "thread_id": "5856", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 2424 }, { "timestamp": "2026-05-28 23:35:04,506", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002568" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Documents" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2425 }, { "timestamp": "2026-05-28 23:35:04,506", "thread_id": "5020", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 3, "id": 2426 }, { "timestamp": "2026-05-28 23:35:04,506", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002568" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Pictures" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2427 }, { "timestamp": "2026-05-28 23:35:04,506", "thread_id": "5856", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 2428 }, { "timestamp": "2026-05-28 23:35:04,506", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002568" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Pictures" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2429 }, { "timestamp": "2026-05-28 23:35:04,506", "thread_id": "8944", "caller": "0x313d68183c7", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2430 }, { "timestamp": "2026-05-28 23:35:04,506", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002524" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Pictures" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2431 }, { "timestamp": "2026-05-28 23:35:04,506", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000dac" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Documents" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2432 }, { "timestamp": "2026-05-28 23:35:04,506", "thread_id": "5856", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2433 }, { "timestamp": "2026-05-28 23:35:04,506", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002460" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Documents" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2434 }, { "timestamp": "2026-05-28 23:35:04,506", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025d0" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Downloads" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2435 }, { "timestamp": "2026-05-28 23:35:04,506", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000da4" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Downloads" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2436 }, { "timestamp": "2026-05-28 23:35:04,506", "thread_id": "4944", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2437 }, { "timestamp": "2026-05-28 23:35:04,506", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000bd4" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Music" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2438 }, { "timestamp": "2026-05-28 23:35:04,506", "thread_id": "4944", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2439 }, { "timestamp": "2026-05-28 23:35:04,506", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000bd4" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Videos" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 2440 }, { "timestamp": "2026-05-28 23:35:04,506", "thread_id": "8944", "caller": "0x313d68197b7", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2441 }, { "timestamp": "2026-05-28 23:35:04,506", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001fac" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Videos" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2442 }, { "timestamp": "2026-05-28 23:35:04,506", "thread_id": "8944", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc5c4b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00d22a40" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2443 }, { "timestamp": "2026-05-28 23:35:04,506", "thread_id": "4944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002478" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Music" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2444 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "8944", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc5c4b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x072dfd58" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2445 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "8944", "caller": "0x313d6819227", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2446 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "8944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbb010329d", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000270c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001fe8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2447 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002464" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10a30000" }, { "name": "SectionOffset", "value": "0x0901be20" }, { "name": "ViewSize", "value": "0x00004000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2448 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "8944", "caller": "0x313d6819167", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 4, "id": 2449 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "5020", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc5c4b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2450 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "8944", "caller": "0x313d6819167", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2451 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "5020", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc5c4b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x0e8cb5d8" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2452 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "5020", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002604" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2453 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "8944", "caller": "0x313d6819367", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2454 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "5020", "caller": "0x7ffbb0111c19", "parentcaller": "0x7ffbb01132af", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002604" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2455 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "5020", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000231c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10a40000" }, { "name": "SectionOffset", "value": "0x07c0e7e0" }, { "name": "ViewSize", "value": "0x00004000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2456 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "5020", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002604" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000de0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2457 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "4748", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 2458 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "5020", "caller": "0x7ffbc54986ed", "parentcaller": "0x7ffbb0109455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000270c" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2459 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "8944", "caller": "0x313d6819167", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 2460 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "5020", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000270c" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2461 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "8944", "caller": "0x313d6819227", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 2462 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "5020", "caller": "0x7ffbb0111c19", "parentcaller": "0x7ffbb0111ae1", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000270c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2463 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "5020", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000ec0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10a50000" }, { "name": "SectionOffset", "value": "0x07c0e760" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2464 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "5020", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbb0111d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000270c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000e7c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2465 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "8944", "caller": "0x313d6819367", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 5, "id": 2466 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "4748", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc5c4b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2467 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "8944", "caller": "0x313d6819227", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 2468 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "4748", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc5c4b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00d22a40" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2469 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "8944", "caller": "0x313d6819167", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 2470 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "4748", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc5c4b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x0e8c9928" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2471 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "5020", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 4, "id": 2472 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "4748", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c0" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2473 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "8944", "caller": "0x313d6819167", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 2474 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "4748", "caller": "0x7ffbb0111c19", "parentcaller": "0x7ffbb01132af", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024c0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2475 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "8944", "caller": "0x313d6819367", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2476 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "4748", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a68" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10b50000" }, { "name": "SectionOffset", "value": "0x09aae600" }, { "name": "ViewSize", "value": "0x00004000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2477 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "4748", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbb0111d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000024c0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002464" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2478 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "5020", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2479 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "4748", "caller": "0x7ffbc54986ed", "parentcaller": "0x7ffbb0109455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000de0" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2480 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "5020", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 2481 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "8944", "caller": "0x313d6818657", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x0ef318f0" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Documents" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 2482 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "8944", "caller": "0x313d6818807", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025f8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Documents\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2483 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "8944", "caller": "0x313d6818657", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025f8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Documents" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 2484 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "4748", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000229c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x113b0000" }, { "name": "SectionOffset", "value": "0x09aae580" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2485 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "4748", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbb0111d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000de0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000022b8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2486 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "8944", "caller": "0x313d6818477", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025f8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Documents" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 2487 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "8944", "caller": "0x313d6818337", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025f8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Documents\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2488 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "8944", "caller": "0x313d6818657", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x000025f8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 2489 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "8944", "caller": "0x313d6818807", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025f8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2490 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "8944", "caller": "0x313d6818657", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025f8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 2491 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "8944", "caller": "0x313d6818337", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025f8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2492 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "8944", "caller": "0x313d6818657", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x000025f8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 2493 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "8944", "caller": "0x313d6818807", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025f8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2494 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "8944", "caller": "0x313d6818657", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025f8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 2495 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "8944", "caller": "0x313d6818337", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025f8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2496 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "8944", "caller": "0x313d6818477", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025f8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 2497 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "8944", "caller": "0x313d6818507", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025f8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2498 }, { "timestamp": "2026-05-28 23:35:04,521", "thread_id": "4748", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 9, "id": 2499 }, { "timestamp": "2026-05-28 23:35:04,709", "thread_id": "4748", "caller": "0x7ffbc54986ed", "parentcaller": "0x7ffbb0109455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002668" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2500 }, { "timestamp": "2026-05-28 23:35:04,709", "thread_id": "4748", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022d8" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2501 }, { "timestamp": "2026-05-28 23:35:04,709", "thread_id": "4748", "caller": "0x7ffbb0111c19", "parentcaller": "0x7ffbb0111ae1", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022d8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2502 }, { "timestamp": "2026-05-28 23:35:04,709", "thread_id": "4748", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002668" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x11ca0000" }, { "name": "SectionOffset", "value": "0x09aae270" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2503 }, { "timestamp": "2026-05-28 23:35:04,709", "thread_id": "4748", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbb0111d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000022d8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000e7c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2504 }, { "timestamp": "2026-05-28 23:35:04,724", "thread_id": "5856", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc5c4b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2505 }, { "timestamp": "2026-05-28 23:35:04,724", "thread_id": "5856", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc5c4b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00d22a40" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2506 }, { "timestamp": "2026-05-28 23:35:04,724", "thread_id": "5856", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc5c4b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x0e8c8f98" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2507 }, { "timestamp": "2026-05-28 23:35:04,724", "thread_id": "5856", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002690" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2508 }, { "timestamp": "2026-05-28 23:35:04,724", "thread_id": "5856", "caller": "0x7ffbb0111c19", "parentcaller": "0x7ffbb01132af", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002690" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2509 }, { "timestamp": "2026-05-28 23:35:04,724", "thread_id": "5856", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000ddc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x11000000" }, { "name": "SectionOffset", "value": "0x0b18e6d0" }, { "name": "ViewSize", "value": "0x00004000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2510 }, { "timestamp": "2026-05-28 23:35:04,724", "thread_id": "5856", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbb0111d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002690" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000020e0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2511 }, { "timestamp": "2026-05-28 23:35:04,724", "thread_id": "5856", "caller": "0x7ffbc54986ed", "parentcaller": "0x7ffbb0109455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002464" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2512 }, { "timestamp": "2026-05-28 23:35:04,724", "thread_id": "5856", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002464" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2513 }, { "timestamp": "2026-05-28 23:35:04,724", "thread_id": "5856", "caller": "0x7ffbb0111c19", "parentcaller": "0x7ffbb0111ae1", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002464" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2514 }, { "timestamp": "2026-05-28 23:35:04,724", "thread_id": "5856", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002914" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x11da0000" }, { "name": "SectionOffset", "value": "0x0b18e650" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2515 }, { "timestamp": "2026-05-28 23:35:04,724", "thread_id": "5856", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbb0111d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002464" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000018fc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2516 }, { "timestamp": "2026-05-28 23:35:04,724", "thread_id": "5856", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 2517 }, { "timestamp": "2026-05-28 23:35:04,724", "thread_id": "5856", "caller": "0x7ffbc54986ed", "parentcaller": "0x7ffbb0109455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000ddc" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2518 }, { "timestamp": "2026-05-28 23:35:04,724", "thread_id": "5856", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002348" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2519 }, { "timestamp": "2026-05-28 23:35:04,724", "thread_id": "5856", "caller": "0x7ffbb0111c19", "parentcaller": "0x7ffbb0111ae1", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002348" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2520 }, { "timestamp": "2026-05-28 23:35:04,724", "thread_id": "5856", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000ddc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x11ea0000" }, { "name": "SectionOffset", "value": "0x0b18e340" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2521 }, { "timestamp": "2026-05-28 23:35:04,724", "thread_id": "5856", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbb0111d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002348" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002890" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2522 }, { "timestamp": "2026-05-28 23:35:04,724", "thread_id": "5856", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 2523 }, { "timestamp": "2026-05-28 23:35:04,724", "thread_id": "5856", "caller": "0x7ffbc54986ed", "parentcaller": "0x7ffbb0109455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022b8" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2524 }, { "timestamp": "2026-05-28 23:35:04,724", "thread_id": "5856", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 2525 }, { "timestamp": "2026-05-28 23:35:04,740", "thread_id": "5856", "caller": "0x7ffbc54986ed", "parentcaller": "0x7ffbb0109455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000e7c" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2526 }, { "timestamp": "2026-05-28 23:35:04,740", "thread_id": "5856", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 2527 }, { "timestamp": "2026-05-28 23:35:04,740", "thread_id": "5856", "caller": "0x7ffbc54986ed", "parentcaller": "0x7ffbb0109455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000026c0" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2528 }, { "timestamp": "2026-05-28 23:35:04,740", "thread_id": "5856", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 2529 }, { "timestamp": "2026-05-28 23:35:04,740", "thread_id": "5856", "caller": "0x7ffbc54986ed", "parentcaller": "0x7ffbb0109455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022dc" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2530 }, { "timestamp": "2026-05-28 23:35:04,740", "thread_id": "5856", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 5, "id": 2531 }, { "timestamp": "2026-05-28 23:35:04,740", "thread_id": "5856", "caller": "0x7ffbc54986ed", "parentcaller": "0x7ffbb0109455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000e7c" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2532 }, { "timestamp": "2026-05-28 23:35:07,146", "thread_id": "8944", "caller": "0x7ffbc7b5ed8a", "parentcaller": "0x7ffbc7b7db07", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0edcf000" }, { "name": "RegionSize", "value": "0x000c8000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2533 }, { "timestamp": "2026-05-28 23:35:07,177", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2534 }, { "timestamp": "2026-05-28 23:35:07,177", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000e78" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x11010000" }, { "name": "SectionOffset", "value": "0x0901bc20" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2535 }, { "timestamp": "2026-05-28 23:35:07,177", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000e78" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x11010000" }, { "name": "SectionOffset", "value": "0x0901da90" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 2536 }, { "timestamp": "2026-05-28 23:35:07,177", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2537 }, { "timestamp": "2026-05-28 23:35:07,177", "thread_id": "4868", "caller": "0x7ffbc649b8ed", "parentcaller": "0x7ffbc5c46d18", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x000022f0", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffbc5c4be80" }, { "name": "Parameter", "value": "0x0324f030" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "8728" }, { "name": "ProcessId", "value": "4692" } ], "repeated": 0, "id": 2538 }, { "timestamp": "2026-05-28 23:35:07,177", "thread_id": "8728", "caller": "0x7ffbc7bafc9c", "parentcaller": "0x7ffbc7baf7b0", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002b08" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\mpr.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2539 }, { "timestamp": "2026-05-28 23:35:07,177", "thread_id": "8728", "caller": "0x7ffbc7b64d42", "parentcaller": "0x7ffbc7b64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002b0c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbb4be0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0001d000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2540 }, { "timestamp": "2026-05-28 23:35:07,177", "thread_id": "8728", "caller": "0x7ffbc7b64d42", "parentcaller": "0x7ffbc7b64aaa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\MPR" }, { "name": "DllBase", "value": "0x7ffbb4be0000" } ], "repeated": 0, "id": 2541 }, { "timestamp": "2026-05-28 23:35:07,193", "thread_id": "8728", "caller": "0x7ffbc7b9bb2a", "parentcaller": "0x7ffbc7b9b99e", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000026c0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\MPR.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2542 }, { "timestamp": "2026-05-28 23:35:07,193", "thread_id": "8728", "caller": "0x7ffbc7b9bbcc", "parentcaller": "0x7ffbc7b9b99e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000010b0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x11010000" }, { "name": "SectionOffset", "value": "0x1128e640" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2543 }, { "timestamp": "2026-05-28 23:35:07,209", "thread_id": "8728", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbb4be19f3", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\drprov" }, { "name": "DllBase", "value": "0x7ffbc0930000" } ], "repeated": 0, "id": 2544 }, { "timestamp": "2026-05-28 23:35:07,209", "thread_id": "8728", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbb4be19f3", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\drprov.dll" }, { "name": "BaseAddress", "value": "0x7ffbc0930000" } ], "repeated": 0, "id": 2545 }, { "timestamp": "2026-05-28 23:35:07,224", "thread_id": "8728", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbb4be19f3", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\ntlanman" }, { "name": "DllBase", "value": "0x7ffbb4ac0000" } ], "repeated": 0, "id": 2546 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbb4be19f3", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\ntlanman.dll" }, { "name": "BaseAddress", "value": "0x7ffbb4ac0000" } ], "repeated": 0, "id": 2547 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbb4be19f3", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\DAVHLPR" }, { "name": "DllBase", "value": "0x7ffbbd8a0000" } ], "repeated": 0, "id": 2548 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbb4be19f3", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\davclnt" }, { "name": "DllBase", "value": "0x7ffbb4500000" } ], "repeated": 0, "id": 2549 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbb4be19f3", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\davclnt.dll" }, { "name": "BaseAddress", "value": "0x7ffbb4500000" } ], "repeated": 0, "id": 2550 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbb4be2d9f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\drprov.dll" }, { "name": "BaseAddress", "value": "0x7ffbc0930000" } ], "repeated": 0, "id": 2551 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc703ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000220c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2552 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbb4be2d9f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\ntlanman.dll" }, { "name": "BaseAddress", "value": "0x7ffbb4ac0000" } ], "repeated": 0, "id": 2553 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc7079a45", "parentcaller": "0x7ffbc707972c", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002328" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PIPE\\wkssvc" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2554 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc5499a46", "parentcaller": "0x7ffbc7079767", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002328" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\wkssvc" }, { "name": "FileInformationClass", "value": "23", "pretty_value": "FilePipeInformation" }, { "name": "FileInformation", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2555 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc707b351", "parentcaller": "0x7ffbc7079798", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002328" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\wkssvc" }, { "name": "FileInformationClass", "value": "41", "pretty_value": "FileIoStatusBlockRangeInformation" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2556 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc7bc5ebd", "parentcaller": "0x7ffbc7bc5dd8", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002328" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\wkssvc" }, { "name": "FileInformationClass", "value": "30", "pretty_value": "FileCompletionInformation" }, { "name": "FileInformation", "value": "\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\xb1\\xa3\\x0e\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2557 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc43914a7", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "cscapi.dll" }, { "name": "BaseAddress", "value": "0x7ffbb1a70000" } ], "repeated": 0, "id": 2558 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbb4ac1426", "parentcaller": "0x7ffbb4be2df6", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022fc" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "\\Device\\DfsClient" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2559 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbb4be2d9f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\davclnt.dll" }, { "name": "BaseAddress", "value": "0x7ffbb4500000" } ], "repeated": 0, "id": 2560 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc7079a45", "parentcaller": "0x7ffbc707972c", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x000002c8" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PIPE\\DAV RPC SERVICE" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2561 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000e78" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x11030000" }, { "name": "SectionOffset", "value": "0x0901e580" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2562 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002afc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x11030000" }, { "name": "SectionOffset", "value": "0x0901e640" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2563 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002afc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x11030000" }, { "name": "SectionOffset", "value": "0x0901e640" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2564 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2565 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002944" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x11030000" }, { "name": "SectionOffset", "value": "0x0901e490" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2566 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2567 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002b34" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2568 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002b34" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2569 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002b34" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2570 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc348d4e4", "parentcaller": "0x7ffbc33c3285", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00a16281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2571 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002b34" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\3D Objects\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2572 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc348d4e4", "parentcaller": "0x7ffbc33c348f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00a16281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2573 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2574 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002688" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x11030000" }, { "name": "SectionOffset", "value": "0x0901d4e0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2575 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000022fc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x11030000" }, { "name": "SectionOffset", "value": "0x0901d340" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2576 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2577 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002b44" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2578 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002b44" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2579 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002b44" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2580 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 3, "id": 2581 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "2404", "caller": "0x7ff627679d60", "parentcaller": "0x7ff627679c74", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2582 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2583 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "6052", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc33c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x4574f454d" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2584 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2585 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002b5c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2586 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "6052", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2587 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002b5c" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2588 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2589 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2590 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2591 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2592 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "8728", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2593 }, { "timestamp": "2026-05-28 23:35:07,240", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2594 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2595 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8728", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2596 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2597 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8944", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc5c4b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2598 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8944", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc5c4b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00d22a40" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2599 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc0\\x16\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2600 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8728", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2601 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8944", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc5c4b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x0e8c8c68" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2602 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8728", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2603 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2604 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002b68" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2605 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8728", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000028a0" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2606 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8728", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000028a0" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2607 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002688" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x107d0000" }, { "name": "SectionOffset", "value": "0x0901dd00" }, { "name": "ViewSize", "value": "0x0000f000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2608 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbb0111d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002b68" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000022fc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2609 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8728", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2610 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\"\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2611 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8728", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2612 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "e\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2613 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "i\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2614 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8944", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000023b8" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2615 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc9\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2616 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8944", "caller": "0x7ffbb0111c19", "parentcaller": "0x7ffbb0111ae1", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000023b8" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2617 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "7\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2618 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002678" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12080000" }, { "name": "SectionOffset", "value": "0x0901dc80" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2619 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8944", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbb0111d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000023b8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002674" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2620 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002688" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\imageres.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2621 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8944", "caller": "0x7ffbc5457786", "parentcaller": "0x7ffbc5455630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x000026b0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2622 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8944", "caller": "0x7ffbc7b9bb2a", "parentcaller": "0x7ffbc7b9b99e", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002688" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\imageres.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2623 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8944", "caller": "0x7ffbc7b9bbcc", "parentcaller": "0x7ffbc7b9b99e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000026b0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109f0000" }, { "name": "SectionOffset", "value": "0x0901c100" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2624 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8944", "caller": "0x7ffbc7b9bb2a", "parentcaller": "0x7ffbc7b9b99e", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\SystemResources\\imageres.dll.mui.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2625 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8944", "caller": "0x7ffbc7b9bb2a", "parentcaller": "0x7ffbc7b9b99e", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000026b0" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\SystemResources\\imageres.dll.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2626 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8944", "caller": "0x7ffbc7b9bbcc", "parentcaller": "0x7ffbc7b9b99e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002670" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x15790000" }, { "name": "SectionOffset", "value": "0x0901c0b0" }, { "name": "ViewSize", "value": "0x013c0000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2627 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xcc\\x17\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2628 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8728", "caller": "0x7ffbc649b8ed", "parentcaller": "0x7ffbb9db3d1b", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00002bac", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffbb9db0c10" }, { "name": "Parameter", "value": "0x047e9170" }, { "name": "CreationFlags", "value": "0x00000004" }, { "name": "ThreadId", "value": "8784" }, { "name": "ProcessId", "value": "4692" } ], "repeated": 0, "id": 2629 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8728", "caller": "0x7ffbc549f430", "parentcaller": "0x7ffbb9db3dc1", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00002bac" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "8784" }, { "name": "ProcessId", "value": "4692" } ], "repeated": 0, "id": 2630 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xce\\x17\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2631 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8944", "caller": "0x7ffbc7bba871", "parentcaller": "0x7ffbc544ad69", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x15790000" }, { "name": "RegionSize", "value": "0x013c0000" } ], "repeated": 0, "id": 2632 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8944", "caller": "0x7ffbc7bba871", "parentcaller": "0x7ffbc544ad69", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109f0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2633 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8944", "caller": "0x7ffbc544ad9e", "parentcaller": "0x7ffbc77cbc42", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x109e0000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 2634 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x1e\\x18\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2635 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8944", "caller": "0x7ffbc54986ed", "parentcaller": "0x7ffbb0109455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000026b0" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2636 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\"\\x18\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2637 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "b\\x18\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2638 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "f\\x18\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2639 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8784", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\PlayToDevice" }, { "name": "DllBase", "value": "0x7ffb6cff0000" } ], "repeated": 0, "id": 2640 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc2\\x18\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2641 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc6\\x18\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2642 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 1, "id": 2643 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2644 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x04\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2645 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "L\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2646 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "N\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2647 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8784", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\PlayToDevice.dll" }, { "name": "BaseAddress", "value": "0x7ffb6cff0000" } ], "repeated": 0, "id": 2648 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa2\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2649 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe1\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2650 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe5\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2651 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8784", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc703ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000265c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2652 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "A\\x16\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2653 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8784", "caller": "0x7ffbc58e50aa", "parentcaller": "0x7ffbc58e52e2", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002ba8" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\DeviceApi\\Dev\\Query" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "0" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2654 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "E\\x16\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2655 }, { "timestamp": "2026-05-28 23:35:07,256", "thread_id": "8784", "caller": "0x7ffbc7bc5ebd", "parentcaller": "0x7ffbc7bc5dd8", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002ba8" }, { "name": "HandleName", "value": "\\Device\\DeviceApi" }, { "name": "FileInformationClass", "value": "30", "pretty_value": "FileCompletionInformation" }, { "name": "FileInformation", "value": "\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x84\\x94\r\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2656 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xb3\\x16\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2657 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "@\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2658 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "D\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2659 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x8c\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2660 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x8e\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2661 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xde\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2662 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "5008", "caller": "0x7ffbc58e6900", "parentcaller": "0x7ffbc58e60f0", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000026b0" }, { "name": "DesiredAccess", "value": "0x80100000", "pretty_value": "GENERIC_READ|SYNCHRONIZE" }, { "name": "FileName", "value": "\\Device\\DeviceApi\\Dev\\Query" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "0" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2663 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe2\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2664 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "5008", "caller": "0x7ffbc58e6900", "parentcaller": "0x7ffbc58e60f0", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000026b0" }, { "name": "DesiredAccess", "value": "0x80100000", "pretty_value": "GENERIC_READ|SYNCHRONIZE" }, { "name": "FileName", "value": "\\Device\\DeviceApi\\Dev\\Query" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "0" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 2665 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 1, "id": 2666 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "$\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2667 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "8728", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2668 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2669 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x84\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2670 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x88\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2671 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xf6\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2672 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2673 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x04\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2674 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "L\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2675 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "N\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2676 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x9e\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2677 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "8728", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbb453f778", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "Comctl32.dll" }, { "name": "BaseAddress", "value": "0x7ffbb1750000" } ], "repeated": 1, "id": 2678 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa2\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2679 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "8728", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2680 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe3\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2681 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe7\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2682 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "C\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2683 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "G\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2684 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "@\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2685 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "u\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2686 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2687 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x84\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2688 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xcc\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2689 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xce\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2690 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x1e\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2691 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "8728", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\EhStorAPI" }, { "name": "DllBase", "value": "0x7ffbb2520000" } ], "repeated": 0, "id": 2692 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\"\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2693 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "e\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2694 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "i\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2695 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc5\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2696 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc9\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2697 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "8728", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\EhStorAPI.dll" }, { "name": "BaseAddress", "value": "0x7ffbb2520000" } ], "repeated": 0, "id": 2698 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000024cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "7\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2699 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "8728", "caller": "0x7ffbc348d4e4", "parentcaller": "0x7ffbc33c3285", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00a16281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2700 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "8728", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000001" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2701 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "8728", "caller": "0x7ffbc348d4e4", "parentcaller": "0x7ffbc33c348f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00a16281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2702 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "8728", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000010a4" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2703 }, { "timestamp": "2026-05-28 23:35:07,271", "thread_id": "8944", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 6, "id": 2704 }, { "timestamp": "2026-05-28 23:35:07,287", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 1, "id": 2705 }, { "timestamp": "2026-05-28 23:35:07,287", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002bbc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\resources\\Themes\\aero\\Shell\\NormalColor\\ShellStyle.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2706 }, { "timestamp": "2026-05-28 23:35:07,287", "thread_id": "8944", "caller": "0x7ffbc5457906", "parentcaller": "0x7ffbc5455630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002bc4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12180000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000f3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2707 }, { "timestamp": "2026-05-28 23:35:07,287", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbb627f40a", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\xmllite.dll" }, { "name": "BaseAddress", "value": "0x7ffbc0d70000" } ], "repeated": 0, "id": 2708 }, { "timestamp": "2026-05-28 23:35:07,287", "thread_id": "8944", "caller": "0x7ffbc544ad9e", "parentcaller": "0x7ffbc5df2fa9", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12180000" }, { "name": "RegionSize", "value": "0x000f3000" } ], "repeated": 0, "id": 2709 }, { "timestamp": "2026-05-28 23:35:07,287", "thread_id": "8944", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 2710 }, { "timestamp": "2026-05-28 23:35:07,287", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 1, "id": 2711 }, { "timestamp": "2026-05-28 23:35:07,287", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d74" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\resources\\Themes\\aero\\Shell\\NormalColor\\ShellStyle.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2712 }, { "timestamp": "2026-05-28 23:35:07,287", "thread_id": "8944", "caller": "0x7ffbc5457906", "parentcaller": "0x7ffbc5455630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002b28" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12180000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000f3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2713 }, { "timestamp": "2026-05-28 23:35:07,287", "thread_id": "8944", "caller": "0x7ffbc544ad9e", "parentcaller": "0x7ffbc5de6a1e", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12180000" }, { "name": "RegionSize", "value": "0x000f3000" } ], "repeated": 0, "id": 2714 }, { "timestamp": "2026-05-28 23:35:07,287", "thread_id": "8944", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 2715 }, { "timestamp": "2026-05-28 23:35:07,287", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 3, "id": 2716 }, { "timestamp": "2026-05-28 23:35:07,334", "thread_id": "4748", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 6, "id": 2717 }, { "timestamp": "2026-05-28 23:35:07,334", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 1, "id": 2718 }, { "timestamp": "2026-05-28 23:35:07,334", "thread_id": "8944", "caller": "0x313d681e847", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 2719 }, { "timestamp": "2026-05-28 23:35:07,334", "thread_id": "8944", "caller": "0x313d6819c37", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2720 }, { "timestamp": "2026-05-28 23:35:07,334", "thread_id": "8944", "caller": "0x313d681e7a7", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2721 }, { "timestamp": "2026-05-28 23:35:07,334", "thread_id": "8944", "caller": "0x313d6818177", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2722 }, { "timestamp": "2026-05-28 23:35:07,334", "thread_id": "8944", "caller": "0x313d681ea57", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 2723 }, { "timestamp": "2026-05-28 23:35:07,334", "thread_id": "8944", "caller": "0x313d6819e47", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2724 }, { "timestamp": "2026-05-28 23:35:07,334", "thread_id": "8944", "caller": "0x313d681e9b7", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2725 }, { "timestamp": "2026-05-28 23:35:07,334", "thread_id": "8944", "caller": "0x313d6818177", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2726 }, { "timestamp": "2026-05-28 23:35:07,334", "thread_id": "8944", "caller": "0x313d681ea57", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 2727 }, { "timestamp": "2026-05-28 23:35:07,334", "thread_id": "8944", "caller": "0x313d6819e47", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2728 }, { "timestamp": "2026-05-28 23:35:07,334", "thread_id": "8944", "caller": "0x313d681e9b7", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2729 }, { "timestamp": "2026-05-28 23:35:07,349", "thread_id": "4864", "caller": "0x7ff62767a0c1", "parentcaller": "0x7ff627678f2b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 1, "id": 2730 }, { "timestamp": "2026-05-28 23:35:07,349", "thread_id": "8944", "caller": "0x313d681ea57", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 2731 }, { "timestamp": "2026-05-28 23:35:07,349", "thread_id": "8944", "caller": "0x313d6819e47", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2732 }, { "timestamp": "2026-05-28 23:35:07,349", "thread_id": "8944", "caller": "0x313d681e9b7", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2733 }, { "timestamp": "2026-05-28 23:35:07,349", "thread_id": "8944", "caller": "0x313d6818177", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2734 }, { "timestamp": "2026-05-28 23:35:07,349", "thread_id": "8944", "caller": "0x313d681ea57", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 2735 }, { "timestamp": "2026-05-28 23:35:07,349", "thread_id": "8944", "caller": "0x313d6819e47", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2736 }, { "timestamp": "2026-05-28 23:35:07,349", "thread_id": "8944", "caller": "0x313d681e9b7", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2737 }, { "timestamp": "2026-05-28 23:35:07,349", "thread_id": "8944", "caller": "0x313d6818177", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2738 }, { "timestamp": "2026-05-28 23:35:07,349", "thread_id": "8944", "caller": "0x313d681ea57", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 2739 }, { "timestamp": "2026-05-28 23:35:07,349", "thread_id": "8944", "caller": "0x313d6819e47", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2740 }, { "timestamp": "2026-05-28 23:35:07,349", "thread_id": "8944", "caller": "0x313d681e9b7", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2741 }, { "timestamp": "2026-05-28 23:35:07,349", "thread_id": "8944", "caller": "0x313d6818177", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2742 }, { "timestamp": "2026-05-28 23:35:07,349", "thread_id": "8944", "caller": "0x313d681ea57", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 2743 }, { "timestamp": "2026-05-28 23:35:07,349", "thread_id": "8944", "caller": "0x313d6819e47", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2744 }, { "timestamp": "2026-05-28 23:35:07,349", "thread_id": "8944", "caller": "0x313d681e9b7", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2745 }, { "timestamp": "2026-05-28 23:35:07,349", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2746 }, { "timestamp": "2026-05-28 23:35:07,349", "thread_id": "5856", "caller": "0x7ffbc54986ed", "parentcaller": "0x7ffbc388b1ad", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002888" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2747 }, { "timestamp": "2026-05-28 23:35:07,349", "thread_id": "5856", "caller": "0x7ffbc54986ed", "parentcaller": "0x7ffbc388b1ad", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000b84" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2748 }, { "timestamp": "2026-05-28 23:35:07,349", "thread_id": "8944", "caller": "0x313d6819067", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 3, "id": 2749 }, { "timestamp": "2026-05-28 23:35:07,349", "thread_id": "5020", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc5c4b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2750 }, { "timestamp": "2026-05-28 23:35:07,349", "thread_id": "8944", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2751 }, { "timestamp": "2026-05-28 23:35:07,349", "thread_id": "4868", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc5c4b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2752 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5020", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022dc" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2753 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "4868", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc5c4b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x0e8ca918" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2754 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "8944", "caller": "0x313d681eea7", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2755 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5020", "caller": "0x7ffbb0111c19", "parentcaller": "0x7ffbb01132af", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022dc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2756 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5020", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002944" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x107e0000" }, { "name": "SectionOffset", "value": "0x07c0e670" }, { "name": "ViewSize", "value": "0x0000f000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2757 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5020", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbb0111d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000022dc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ad4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2758 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "4868", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002888" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2759 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "8944", "caller": "0x313d6819067", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 2760 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5020", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022fc" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2761 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "4868", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbb0111d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002888" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002b34" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2762 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "8944", "caller": "0x313d68190a7", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2763 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "4868", "caller": "0x7ffbc54986ed", "parentcaller": "0x7ffbb0109455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000020e0" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2764 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5020", "caller": "0x7ffbb0111c19", "parentcaller": "0x7ffbb0111ae1", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000022fc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2765 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "8944", "caller": "0x313d6819067", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2766 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5020", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002958" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12180000" }, { "name": "SectionOffset", "value": "0x07c0e5f0" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2767 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5020", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbb0111d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000022fc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000028dc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2768 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "8944", "caller": "0x313d681eea7", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2769 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5020", "caller": "0x7ffbc7b9bb2a", "parentcaller": "0x7ffbc7b9b99e", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002944" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\imageres.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2770 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5020", "caller": "0x7ffbc7b9bbcc", "parentcaller": "0x7ffbc7b9b99e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002654" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10a20000" }, { "name": "SectionOffset", "value": "0x07c0ca70" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2771 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "8944", "caller": "0x313d68190a7", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2772 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5020", "caller": "0x7ffbc7b9bb2a", "parentcaller": "0x7ffbc7b9b99e", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\SystemResources\\imageres.dll.mui.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2773 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "4868", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000020e0" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2774 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "8944", "caller": "0x313d6819067", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 2775 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "4868", "caller": "0x7ffbb0111c19", "parentcaller": "0x7ffbb0111ae1", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000020e0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2776 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "8944", "caller": "0x313d68190a7", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2777 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "4868", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001f4c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12280000" }, { "name": "SectionOffset", "value": "0x0324e820" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2778 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "4868", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbb0111d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000020e0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002b3c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2779 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5020", "caller": "0x7ffbc7bba871", "parentcaller": "0x7ffbc544ad69", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x15790000" }, { "name": "RegionSize", "value": "0x013c0000" } ], "repeated": 0, "id": 2780 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5020", "caller": "0x7ffbc7bba871", "parentcaller": "0x7ffbc544ad69", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10a20000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2781 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5020", "caller": "0x7ffbc544ad9e", "parentcaller": "0x7ffbc77cbc42", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10a10000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 2782 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "8944", "caller": "0x313d6819067", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 2783 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5020", "caller": "0x7ffbc54986ed", "parentcaller": "0x7ffbb0109455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002654" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2784 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "4868", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 2, "id": 2785 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5856", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc5c4b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2786 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5856", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc5c4b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00d22a40" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2787 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5856", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc5c4b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x0e8cc298" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2788 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "4868", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2789 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5856", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002abc" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2790 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5856", "caller": "0x7ffbb0111c19", "parentcaller": "0x7ffbb01132af", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002abc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2791 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5856", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002b4c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10a10000" }, { "name": "SectionOffset", "value": "0x0b18e760" }, { "name": "ViewSize", "value": "0x0000f000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2792 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5856", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbb0111d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00002abc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000010a0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2793 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5856", "caller": "0x7ffbc54986ed", "parentcaller": "0x7ffbb0109455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002ad4" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2794 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5856", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001900" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2795 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5856", "caller": "0x7ffbb0111c19", "parentcaller": "0x7ffbb0111ae1", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001900" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2796 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5856", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002b30" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12380000" }, { "name": "SectionOffset", "value": "0x0b18e6e0" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2797 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5856", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbb0111d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001900" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000290c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2798 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5020", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2799 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5856", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a8c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\imageres.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2800 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5856", "caller": "0x7ffbc5457786", "parentcaller": "0x7ffbc5455630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x000028dc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10a20000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2801 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5856", "caller": "0x7ffbc7b9bb2a", "parentcaller": "0x7ffbc7b9b99e", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a8c" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\imageres.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2802 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5856", "caller": "0x7ffbc7b9bbcc", "parentcaller": "0x7ffbc7b9b99e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000028dc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10fc0000" }, { "name": "SectionOffset", "value": "0x0b18cb60" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2803 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5856", "caller": "0x7ffbc7b9bb2a", "parentcaller": "0x7ffbc7b9b99e", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\SystemResources\\imageres.dll.mui.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2804 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5856", "caller": "0x7ffbc7b9bb2a", "parentcaller": "0x7ffbc7b9b99e", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000028dc" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\SystemResources\\imageres.dll.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2805 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5856", "caller": "0x7ffbc7b9bbcc", "parentcaller": "0x7ffbc7b9b99e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002910" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x15790000" }, { "name": "SectionOffset", "value": "0x0b18cb10" }, { "name": "ViewSize", "value": "0x013c0000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2806 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5856", "caller": "0x7ffbc7bba871", "parentcaller": "0x7ffbc544ad69", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x15790000" }, { "name": "RegionSize", "value": "0x013c0000" } ], "repeated": 0, "id": 2807 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5856", "caller": "0x7ffbc7bba871", "parentcaller": "0x7ffbc544ad69", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10fc0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2808 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5856", "caller": "0x7ffbc544ad9e", "parentcaller": "0x7ffbc77cbc42", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10a20000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 2809 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5856", "caller": "0x7ffbc54986ed", "parentcaller": "0x7ffbb0109455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000028dc" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2810 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5020", "caller": "0x7ffbc54986ed", "parentcaller": "0x7ffbb0109455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002b50" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2811 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5020", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000109c" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2812 }, { "timestamp": "2026-05-28 23:35:07,365", "thread_id": "5020", "caller": "0x7ffbb0111c19", "parentcaller": "0x7ffbb0111ae1", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000109c" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2813 }, { "timestamp": "2026-05-28 23:35:07,381", "thread_id": "5020", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002b50" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12480000" }, { "name": "SectionOffset", "value": "0x07c0e250" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2814 }, { "timestamp": "2026-05-28 23:35:07,381", "thread_id": "5020", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbb0111d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000109c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002910" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2815 }, { "timestamp": "2026-05-28 23:35:07,381", "thread_id": "5020", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2816 }, { "timestamp": "2026-05-28 23:35:07,381", "thread_id": "5020", "caller": "0x7ffbc54986ed", "parentcaller": "0x7ffbb0109455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a8c" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2817 }, { "timestamp": "2026-05-28 23:35:07,381", "thread_id": "5020", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2818 }, { "timestamp": "2026-05-28 23:35:07,381", "thread_id": "5020", "caller": "0x7ffbc54986ed", "parentcaller": "0x7ffbb0109455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a94" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2819 }, { "timestamp": "2026-05-28 23:35:07,381", "thread_id": "5020", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2820 }, { "timestamp": "2026-05-28 23:35:07,381", "thread_id": "5020", "caller": "0x7ffbc54986ed", "parentcaller": "0x7ffbb0109455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002aa0" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2821 }, { "timestamp": "2026-05-28 23:35:07,381", "thread_id": "5020", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2822 }, { "timestamp": "2026-05-28 23:35:07,381", "thread_id": "8944", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0db7c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2823 }, { "timestamp": "2026-05-28 23:35:07,381", "thread_id": "5020", "caller": "0x7ffbc54986ed", "parentcaller": "0x7ffbb0109455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002b4c" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2824 }, { "timestamp": "2026-05-28 23:35:07,381", "thread_id": "5020", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2825 }, { "timestamp": "2026-05-28 23:35:07,381", "thread_id": "5020", "caller": "0x7ffbc54986ed", "parentcaller": "0x7ffbb0109455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002ab0" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2826 }, { "timestamp": "2026-05-28 23:35:07,396", "thread_id": "5020", "caller": "0x7ffbc54986ed", "parentcaller": "0x7ffbb0109455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2827 }, { "timestamp": "2026-05-28 23:35:08,256", "thread_id": "8944", "caller": "0x313d681e1b7", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 5, "id": 2828 }, { "timestamp": "2026-05-28 23:35:08,256", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000107c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x086a0000" }, { "name": "SectionOffset", "value": "0x0901bc20" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2829 }, { "timestamp": "2026-05-28 23:35:08,256", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000107c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x086a0000" }, { "name": "SectionOffset", "value": "0x0901da90" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 1, "id": 2830 }, { "timestamp": "2026-05-28 23:35:08,256", "thread_id": "5856", "caller": "0x7ffbc649b8ed", "parentcaller": "0x7ffbc5c46d18", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00002ab0", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffbc5c4be80" }, { "name": "Parameter", "value": "0x0b18f060" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "4708" }, { "name": "ProcessId", "value": "4692" } ], "repeated": 0, "id": 2831 }, { "timestamp": "2026-05-28 23:35:08,256", "thread_id": "4708", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc703ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001078" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2832 }, { "timestamp": "2026-05-28 23:35:08,256", "thread_id": "4708", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2833 }, { "timestamp": "2026-05-28 23:35:08,256", "thread_id": "4708", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001080" }, { "name": "DesiredAccess", "value": "0x00100081", "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Downloads" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2834 }, { "timestamp": "2026-05-28 23:35:08,256", "thread_id": "5856", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2835 }, { "timestamp": "2026-05-28 23:35:08,271", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000107c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x086a0000" }, { "name": "SectionOffset", "value": "0x0901e580" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2836 }, { "timestamp": "2026-05-28 23:35:08,271", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000010ac" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x086a0000" }, { "name": "SectionOffset", "value": "0x0901e640" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2837 }, { "timestamp": "2026-05-28 23:35:08,271", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000010ac" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x086a0000" }, { "name": "SectionOffset", "value": "0x0901e640" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2838 }, { "timestamp": "2026-05-28 23:35:08,271", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 2, "id": 2839 }, { "timestamp": "2026-05-28 23:35:08,271", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001070" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\resources\\Themes\\aero\\Shell\\NormalColor\\ShellStyle.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2840 }, { "timestamp": "2026-05-28 23:35:08,271", "thread_id": "8944", "caller": "0x7ffbc5457906", "parentcaller": "0x7ffbc5455630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000106c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12660000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000f3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2841 }, { "timestamp": "2026-05-28 23:35:08,271", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbb627f40a", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\xmllite.dll" }, { "name": "BaseAddress", "value": "0x7ffbc0d70000" } ], "repeated": 0, "id": 2842 }, { "timestamp": "2026-05-28 23:35:08,271", "thread_id": "8944", "caller": "0x7ffbc544ad9e", "parentcaller": "0x7ffbc5df2fa9", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12660000" }, { "name": "RegionSize", "value": "0x000f3000" } ], "repeated": 0, "id": 2843 }, { "timestamp": "2026-05-28 23:35:08,271", "thread_id": "8944", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 2844 }, { "timestamp": "2026-05-28 23:35:08,271", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 1, "id": 2845 }, { "timestamp": "2026-05-28 23:35:08,271", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000106c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\resources\\Themes\\aero\\Shell\\NormalColor\\ShellStyle.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2846 }, { "timestamp": "2026-05-28 23:35:08,271", "thread_id": "8944", "caller": "0x7ffbc5457906", "parentcaller": "0x7ffbc5455630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001070" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12660000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000f3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2847 }, { "timestamp": "2026-05-28 23:35:08,271", "thread_id": "8944", "caller": "0x7ffbc544ad9e", "parentcaller": "0x7ffbc5de6a1e", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12660000" }, { "name": "RegionSize", "value": "0x000f3000" } ], "repeated": 0, "id": 2848 }, { "timestamp": "2026-05-28 23:35:08,271", "thread_id": "8944", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 2849 }, { "timestamp": "2026-05-28 23:35:08,271", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 1, "id": 2850 }, { "timestamp": "2026-05-28 23:35:08,271", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000eb8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x086a0000" }, { "name": "SectionOffset", "value": "0x0901e490" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2851 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000eb8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x086a0000" }, { "name": "SectionOffset", "value": "0x0901d4e0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2852 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000e78" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x086a0000" }, { "name": "SectionOffset", "value": "0x0901d340" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2853 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "8944", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2854 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "2404", "caller": "0x7ff627679d60", "parentcaller": "0x7ff627679c74", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2855 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "8944", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2856 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "6052", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc33c9e99", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x4574f454d" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2857 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2858 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "6052", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2859 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2860 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 2861 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "8944", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2862 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2863 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "8944", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2864 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2865 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2866 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2867 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x11\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2868 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc0\\x16\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2869 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "@\\x19\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2870 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2871 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "8944", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 1, "id": 2872 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x84\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2873 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xcc\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2874 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xce\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2875 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x1e\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2876 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\"\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2877 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "e\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2878 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "i\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2879 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc5\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2880 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc9\\x0c\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2881 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 2, "id": 2882 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "7\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2883 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2884 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80\\x17\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2885 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 1, "id": 2886 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x84\\x17\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2887 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "8944", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2888 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xcc\\x17\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2889 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xce\\x17\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2890 }, { "timestamp": "2026-05-28 23:35:08,287", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x1e\\x18\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2891 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\"\\x18\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2892 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "b\\x18\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2893 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "f\\x18\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2894 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc2\\x18\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2895 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc6\\x18\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2896 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "4\\x19\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2897 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2898 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x04\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2899 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "L\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2900 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "N\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2901 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x9e\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2902 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa2\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2903 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe1\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2904 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe5\\x15\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2905 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "A\\x16\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2906 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "E\\x16\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2907 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xb3\\x16\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2908 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "@\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2909 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "D\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2910 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x8c\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2911 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x8e\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2912 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xde\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2913 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe2\r\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2914 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2915 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "$\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2916 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2917 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x84\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2918 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x88\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2919 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xf6\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2920 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2921 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x04\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2922 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "L\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2923 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "N\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2924 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x9e\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2925 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa2\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2926 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe3\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2927 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe7\\x08\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2928 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "C\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2929 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "G\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2930 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "@\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2931 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "u\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2932 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2933 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x84\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2934 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xcc\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2935 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xce\t\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2936 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x1e\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2937 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\"\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2938 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "e\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2939 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "i\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2940 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc5\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2941 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc9\n\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2942 }, { "timestamp": "2026-05-28 23:35:08,302", "thread_id": "6052", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc3492234", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001098" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "7\\x0b\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2943 }, { "timestamp": "2026-05-28 23:35:08,334", "thread_id": "5020", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2944 }, { "timestamp": "2026-05-28 23:35:08,334", "thread_id": "5020", "caller": "0x7ffbc7b95f9c", "parentcaller": "0x7ffbc7b95bbb", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x086c0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 3, "id": 2945 }, { "timestamp": "2026-05-28 23:35:08,334", "thread_id": "8944", "caller": "0x7ffbc5456bcf", "parentcaller": "0x7ffbc5456f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x033c0f2c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Downloads" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 2946 }, { "timestamp": "2026-05-28 23:35:08,334", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002928" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Downloads\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2947 }, { "timestamp": "2026-05-28 23:35:08,334", "thread_id": "8944", "caller": "0x7ffbc5456c28", "parentcaller": "0x7ffbc5456f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002928" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Downloads" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 2948 }, { "timestamp": "2026-05-28 23:35:08,334", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002928" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Downloads\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2949 }, { "timestamp": "2026-05-28 23:35:08,334", "thread_id": "8944", "caller": "0x7ffbc5456bcf", "parentcaller": "0x7ffbc5456f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00002928" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 2950 }, { "timestamp": "2026-05-28 23:35:08,334", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002928" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2951 }, { "timestamp": "2026-05-28 23:35:08,334", "thread_id": "8944", "caller": "0x7ffbc5456c28", "parentcaller": "0x7ffbc5456f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002928" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 2952 }, { "timestamp": "2026-05-28 23:35:08,334", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002928" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2953 }, { "timestamp": "2026-05-28 23:35:08,334", "thread_id": "8944", "caller": "0x7ffbc5456bcf", "parentcaller": "0x7ffbc5456f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00002928" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 2954 }, { "timestamp": "2026-05-28 23:35:08,334", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002928" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2955 }, { "timestamp": "2026-05-28 23:35:08,334", "thread_id": "8944", "caller": "0x7ffbc5456c28", "parentcaller": "0x7ffbc5456f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002928" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 2956 }, { "timestamp": "2026-05-28 23:35:08,334", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002928" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2957 }, { "timestamp": "2026-05-28 23:35:08,334", "thread_id": "8944", "caller": "0x7ffbc5454d82", "parentcaller": "0x7ffbc54570c7", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002928" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 2958 }, { "timestamp": "2026-05-28 23:35:08,334", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5454f8e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002928" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2959 }, { "timestamp": "2026-05-28 23:35:08,334", "thread_id": "4748", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000e78" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Downloads\\BadooMovies.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2960 }, { "timestamp": "2026-05-28 23:35:08,334", "thread_id": "4748", "caller": "0x7ffbc64942c4", "parentcaller": "0x7ffbc6493b55", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000eb8" }, { "name": "DesiredAccess", "value": "0x001200a9", "pretty_value": "FILE_GENERIC_READ|FILE_GENERIC_EXECUTE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Downloads\\BadooMovies.exe" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2961 }, { "timestamp": "2026-05-28 23:35:08,334", "thread_id": "4748", "caller": "0x7ffbc64944a6", "parentcaller": "0x7ffbc6493b55", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x4000000e", "arguments": [ { "name": "SectionHandle", "value": "0x00000934" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12660000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x001cc000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2962 }, { "timestamp": "2026-05-28 23:35:08,334", "thread_id": "4748", "caller": "0x7ffbc64a607d", "parentcaller": "0x7ffbc649521b", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x001200a9", "pretty_value": "FILE_GENERIC_READ|FILE_GENERIC_EXECUTE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Downloads\\BadooMovies.exe.Config" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2963 }, { "timestamp": "2026-05-28 23:35:08,334", "thread_id": "4748", "caller": "0x7ffbc64946a1", "parentcaller": "0x7ffbc6493b55", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12660000" }, { "name": "RegionSize", "value": "0x001cc000" } ], "repeated": 0, "id": 2964 }, { "timestamp": "2026-05-28 23:35:08,334", "thread_id": "4748", "caller": "0x7ffbc7bd290d", "parentcaller": "0x7ffbc7b635db", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x086d0000" }, { "name": "RegionSize", "value": "0x00002000" } ], "repeated": 0, "id": 2965 }, { "timestamp": "2026-05-28 23:35:08,349", "thread_id": "4748", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000010cc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Downloads\\BadooMovies.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2966 }, { "timestamp": "2026-05-28 23:35:08,349", "thread_id": "4748", "caller": "0x7ffbc5457786", "parentcaller": "0x7ffbc5455630", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x4000000e", "arguments": [ { "name": "SectionHandle", "value": "0x00001080" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12660000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x001cc000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2967 }, { "timestamp": "2026-05-28 23:35:08,349", "thread_id": "4748", "caller": "0x7ffbc7b9bb2a", "parentcaller": "0x7ffbc7b9b99e", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\SystemResources\\BadooMovies.exe.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2968 }, { "timestamp": "2026-05-28 23:35:08,349", "thread_id": "4748", "caller": "0x7ffbc544ad9e", "parentcaller": "0x7ffbc77cbc42", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12660000" }, { "name": "RegionSize", "value": "0x001cc000" } ], "repeated": 0, "id": 2969 }, { "timestamp": "2026-05-28 23:35:08,349", "thread_id": "4748", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc5c4b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2970 }, { "timestamp": "2026-05-28 23:35:08,349", "thread_id": "4748", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc5c4b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x00d22a40" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2971 }, { "timestamp": "2026-05-28 23:35:08,349", "thread_id": "4748", "caller": "0x7ffbc5459dd2", "parentcaller": "0x7ffbc5c4b531", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000035", "pretty_return": "OBJECT_NAME_COLLISION", "arguments": [ { "name": "FileHandle", "value": "0x0e8cb908" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "CreateDisposition", "value": "2", "pretty_value": "FILE_CREATE" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2972 }, { "timestamp": "2026-05-28 23:35:08,349", "thread_id": "4748", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000010cc" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2973 }, { "timestamp": "2026-05-28 23:35:08,349", "thread_id": "4748", "caller": "0x7ffbb0111c19", "parentcaller": "0x7ffbb01132af", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000010cc" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2974 }, { "timestamp": "2026-05-28 23:35:08,349", "thread_id": "4748", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001080" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x086d0000" }, { "name": "SectionOffset", "value": "0x09aad450" }, { "name": "ViewSize", "value": "0x0000f000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2975 }, { "timestamp": "2026-05-28 23:35:08,349", "thread_id": "4748", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbb0111d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000010cc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ab0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2976 }, { "timestamp": "2026-05-28 23:35:08,349", "thread_id": "4748", "caller": "0x7ffbc54986ed", "parentcaller": "0x7ffbb0109455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000010a0" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2977 }, { "timestamp": "2026-05-28 23:35:08,349", "thread_id": "4748", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000010a0" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2978 }, { "timestamp": "2026-05-28 23:35:08,349", "thread_id": "4748", "caller": "0x7ffbb0111c19", "parentcaller": "0x7ffbb0111ae1", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000010a0" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2979 }, { "timestamp": "2026-05-28 23:35:08,349", "thread_id": "4748", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002184" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12660000" }, { "name": "SectionOffset", "value": "0x09aad3d0" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2980 }, { "timestamp": "2026-05-28 23:35:08,349", "thread_id": "4748", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbb0111d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000010a0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000295c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2981 }, { "timestamp": "2026-05-28 23:35:08,349", "thread_id": "4748", "caller": "0x7ffbc54986ed", "parentcaller": "0x7ffbb0109455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001080" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2982 }, { "timestamp": "2026-05-28 23:35:08,349", "thread_id": "4748", "caller": "0x7ffbc54986ed", "parentcaller": "0x7ffbb0109455", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002674" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer" }, { "name": "ShareAccess", "value": "0" } ], "repeated": 0, "id": 2983 }, { "timestamp": "2026-05-28 23:35:08,349", "thread_id": "4748", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001080" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_16.db" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2984 }, { "timestamp": "2026-05-28 23:35:08,349", "thread_id": "4748", "caller": "0x7ffbb0111c19", "parentcaller": "0x7ffbb0111ae1", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001080" }, { "name": "HandleName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_16.db" }, { "name": "FileInformationClass", "value": "74" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 2985 }, { "timestamp": "2026-05-28 23:35:08,349", "thread_id": "4748", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002674" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12760000" }, { "name": "SectionOffset", "value": "0x09aad640" }, { "name": "ViewSize", "value": "0x00100000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2986 }, { "timestamp": "2026-05-28 23:35:08,349", "thread_id": "4748", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbb0111d16", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001080" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002ae4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 2987 }, { "timestamp": "2026-05-28 23:35:08,396", "thread_id": "4864", "caller": "0x7ff62767a0c1", "parentcaller": "0x7ff627678f2b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2988 }, { "timestamp": "2026-05-28 23:35:08,443", "thread_id": "5856", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\ntshrui.dll" }, { "name": "BaseAddress", "value": "0x7ffbaf650000" } ], "repeated": 0, "id": 2989 }, { "timestamp": "2026-05-28 23:35:08,443", "thread_id": "5856", "caller": "0x7ffbc545cd36", "parentcaller": "0x7ffbaf65c28f", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002aac" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 2990 }, { "timestamp": "2026-05-28 23:35:08,459", "thread_id": "5856", "caller": "0x7ffbc4354f57", "parentcaller": "0x7ffbc4354e70", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002aac" }, { "name": "DesiredAccess", "value": "0x00020080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\Downloads" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2991 }, { "timestamp": "2026-05-28 23:35:08,459", "thread_id": "5856", "caller": "0x7ffbc4354f57", "parentcaller": "0x7ffbc4354c79", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002908" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2992 }, { "timestamp": "2026-05-28 23:35:08,459", "thread_id": "5856", "caller": "0x7ffbc545cd36", "parentcaller": "0x7ffbaf65c28f", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002aac" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 2993 }, { "timestamp": "2026-05-28 23:35:08,459", "thread_id": "5856", "caller": "0x7ffbc4354f57", "parentcaller": "0x7ffbc4354e70", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002aac" }, { "name": "DesiredAccess", "value": "0x00020080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\Downloads" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2994 }, { "timestamp": "2026-05-28 23:35:08,459", "thread_id": "5856", "caller": "0x7ffbc4354f57", "parentcaller": "0x7ffbc4354c79", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002908" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2995 }, { "timestamp": "2026-05-28 23:35:08,459", "thread_id": "5856", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 2996 }, { "timestamp": "2026-05-28 23:35:08,459", "thread_id": "5856", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2997 }, { "timestamp": "2026-05-28 23:35:08,943", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 1, "id": 2998 }, { "timestamp": "2026-05-28 23:35:08,943", "thread_id": "4868", "caller": "0x7ffbc545cd36", "parentcaller": "0x7ffbaf65c28f", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f04" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 2999 }, { "timestamp": "2026-05-28 23:35:08,943", "thread_id": "4868", "caller": "0x7ffbc4354f57", "parentcaller": "0x7ffbc4354e70", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f04" }, { "name": "DesiredAccess", "value": "0x00020080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\Downloads" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 3000 }, { "timestamp": "2026-05-28 23:35:08,943", "thread_id": "4868", "caller": "0x7ffbc4354f57", "parentcaller": "0x7ffbc4354c79", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001eb4" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 3001 }, { "timestamp": "2026-05-28 23:35:08,943", "thread_id": "4868", "caller": "0x7ffbc545cd36", "parentcaller": "0x7ffbaf65c28f", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f04" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3002 }, { "timestamp": "2026-05-28 23:35:08,943", "thread_id": "4868", "caller": "0x7ffbc4354f57", "parentcaller": "0x7ffbc4354e70", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f04" }, { "name": "DesiredAccess", "value": "0x00020080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\Downloads" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 3003 }, { "timestamp": "2026-05-28 23:35:08,943", "thread_id": "4868", "caller": "0x7ffbc4354f57", "parentcaller": "0x7ffbc4354c79", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001eb4" }, { "name": "DesiredAccess", "value": "0x00020000", "pretty_value": "READ_CONTROL" }, { "name": "FileName", "value": "C:\\Users\\admin\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 3004 }, { "timestamp": "2026-05-28 23:35:08,959", "thread_id": "4868", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 3005 }, { "timestamp": "2026-05-28 23:35:08,959", "thread_id": "4868", "caller": "0x7ffbc71ff303", "parentcaller": "0x7ffbc71fe7f3", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3006 }, { "timestamp": "2026-05-28 23:35:08,959", "thread_id": "5020", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 1, "id": 3007 }, { "timestamp": "2026-05-28 23:35:08,959", "thread_id": "5020", "caller": "0x7ffbc544fcb5", "parentcaller": "0x7ffbc544facc", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002928" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 3008 }, { "timestamp": "2026-05-28 23:35:08,959", "thread_id": "5020", "caller": "0x7ffbc544fcb5", "parentcaller": "0x7ffbc544facc", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002928" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 3009 }, { "timestamp": "2026-05-28 23:35:08,959", "thread_id": "5020", "caller": "0x7ffbc544fcb5", "parentcaller": "0x7ffbc544facc", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002928" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 3010 }, { "timestamp": "2026-05-28 23:35:08,959", "thread_id": "5020", "caller": "0x7ffbc545cd36", "parentcaller": "0x7ffbc5d621a0", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002928" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3011 }, { "timestamp": "2026-05-28 23:35:08,959", "thread_id": "5020", "caller": "0x7ffbc5454d82", "parentcaller": "0x7ffbc545693c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002928" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3012 }, { "timestamp": "2026-05-28 23:35:08,959", "thread_id": "5020", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5454f8e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002928" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 2, "id": 3013 }, { "timestamp": "2026-05-28 23:35:08,959", "thread_id": "5020", "caller": "0x7ffbc4354f57", "parentcaller": "0x7ffbc4354e70", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002928" }, { "name": "DesiredAccess", "value": "0x00020080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL" }, { "name": "FileName", "value": "C:\\$Recycle.Bin\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 3014 }, { "timestamp": "2026-05-28 23:35:08,959", "thread_id": "5020", "caller": "0x7ffbc348d4e4", "parentcaller": "0x7ffbc33c3285", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00b44281" }, { "name": "Buffer", "value": "\\x01" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3015 }, { "timestamp": "2026-05-28 23:35:08,959", "thread_id": "5020", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002928" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\$Recycle.Bin\\S-1-5-21-3968686040-3210279463-847977608-1001\\desktop.ini" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3016 }, { "timestamp": "2026-05-28 23:35:08,959", "thread_id": "5020", "caller": "0x7ffbc348d4e4", "parentcaller": "0x7ffbc33c348f", "category": "process", "api": "WriteProcessMemory", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00b44281" }, { "name": "Buffer", "value": "\\x00" }, { "name": "BufferLength", "value": "0x00000001" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3017 }, { "timestamp": "2026-05-28 23:35:09,084", "thread_id": "8944", "caller": "0x7ffbc649b8ed", "parentcaller": "0x7ffbc5c46d18", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00002a68", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffbc5c4be80" }, { "name": "Parameter", "value": "0x0901e400" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "10056" }, { "name": "ProcessId", "value": "4692" } ], "repeated": 0, "id": 3018 }, { "timestamp": "2026-05-28 23:35:09,084", "thread_id": "10056", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc703ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000022e8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 3019 }, { "timestamp": "2026-05-28 23:35:09,099", "thread_id": "10056", "caller": "0x7ffbc544fcb5", "parentcaller": "0x7ffbc5495984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002908" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 3020 }, { "timestamp": "2026-05-28 23:35:09,099", "thread_id": "10056", "caller": "0x7ffbc544fcb5", "parentcaller": "0x7ffbc5495984", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002908" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 3021 }, { "timestamp": "2026-05-28 23:35:09,099", "thread_id": "10056", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc549c32f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ff8" }, { "name": "DesiredAccess", "value": "0x00120080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Downloads\\BadooMovies.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3022 }, { "timestamp": "2026-05-28 23:35:09,099", "thread_id": "10056", "caller": "0x7ffbc648c182", "parentcaller": "0x7ffbc648be4b", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ff8" }, { "name": "DesiredAccess", "value": "0x80100000", "pretty_value": "GENERIC_READ|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Downloads\\BadooMovies.exe:Zone.Identifier" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 3023 }, { "timestamp": "2026-05-28 23:35:09,099", "thread_id": "10056", "caller": "0x7ffbc648c28c", "parentcaller": "0x7ffbc648be4b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12860000" }, { "name": "RegionSize", "value": "0x00101000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3024 }, { "timestamp": "2026-05-28 23:35:09,099", "thread_id": "10056", "caller": "0x7ffbc648c2bf", "parentcaller": "0x7ffbc648be4b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12860000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3025 }, { "timestamp": "2026-05-28 23:35:09,099", "thread_id": "10056", "caller": "0x7ffbc648c182", "parentcaller": "0x7ffbc648be4b", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ff8" }, { "name": "DesiredAccess", "value": "0x80100000", "pretty_value": "GENERIC_READ|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Downloads\\BadooMovies.exe:Zone.Identifier" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 3026 }, { "timestamp": "2026-05-28 23:35:09,099", "thread_id": "10056", "caller": "0x7ffbc648c28c", "parentcaller": "0x7ffbc648be4b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12860000" }, { "name": "RegionSize", "value": "0x00101000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3027 }, { "timestamp": "2026-05-28 23:35:09,099", "thread_id": "10056", "caller": "0x7ffbc648c2bf", "parentcaller": "0x7ffbc648be4b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x12860000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3028 }, { "timestamp": "2026-05-28 23:35:09,099", "thread_id": "10056", "caller": "0x7ffbc5456bcf", "parentcaller": "0x7ffbc5456f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ff8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Downloads\\BadooMovies.exe" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 2, "id": 3029 }, { "timestamp": "2026-05-28 23:35:09,099", "thread_id": "10056", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455cb3", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000033", "pretty_return": "OBJECT_NAME_INVALID", "arguments": [ { "name": "FileHandle", "value": "0x00000010" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Downloads\\BadooMovies.exe\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3030 }, { "timestamp": "2026-05-28 23:35:09,099", "thread_id": "10056", "caller": "0x7ffbc5456bcf", "parentcaller": "0x7ffbc5456f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x7ffbc5de207c" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Downloads" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3031 }, { "timestamp": "2026-05-28 23:35:09,099", "thread_id": "10056", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ff8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Downloads\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3032 }, { "timestamp": "2026-05-28 23:35:09,099", "thread_id": "10056", "caller": "0x7ffbc5456c28", "parentcaller": "0x7ffbc5456f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ff8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Downloads" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 3033 }, { "timestamp": "2026-05-28 23:35:09,099", "thread_id": "10056", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ff8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\Downloads\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3034 }, { "timestamp": "2026-05-28 23:35:09,099", "thread_id": "10056", "caller": "0x7ffbc5456bcf", "parentcaller": "0x7ffbc5456f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00001ff8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3035 }, { "timestamp": "2026-05-28 23:35:09,099", "thread_id": "10056", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ff8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3036 }, { "timestamp": "2026-05-28 23:35:09,099", "thread_id": "10056", "caller": "0x7ffbc5456c28", "parentcaller": "0x7ffbc5456f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ff8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 3037 }, { "timestamp": "2026-05-28 23:35:09,099", "thread_id": "10056", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ff8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3038 }, { "timestamp": "2026-05-28 23:35:09,099", "thread_id": "10056", "caller": "0x7ffbc5456bcf", "parentcaller": "0x7ffbc5456f7c", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00001ff8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3039 }, { "timestamp": "2026-05-28 23:35:09,099", "thread_id": "10056", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ff8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3040 }, { "timestamp": "2026-05-28 23:35:09,099", "thread_id": "10056", "caller": "0x7ffbc5456c28", "parentcaller": "0x7ffbc5456f7c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ff8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 1, "id": 3041 }, { "timestamp": "2026-05-28 23:35:09,099", "thread_id": "10056", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455cb3", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ff8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3042 }, { "timestamp": "2026-05-28 23:35:09,099", "thread_id": "10056", "caller": "0x7ffbc5454d82", "parentcaller": "0x7ffbc54570c7", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ff8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3043 }, { "timestamp": "2026-05-28 23:35:09,099", "thread_id": "10056", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5454f8e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ff8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3044 }, { "timestamp": "2026-05-28 23:35:09,099", "thread_id": "10056", "caller": "0x7ffbc5454d82", "parentcaller": "0x7ffbc545693c", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ff8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3045 }, { "timestamp": "2026-05-28 23:35:09,099", "thread_id": "10056", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5454f8e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ff8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3046 }, { "timestamp": "2026-05-28 23:35:09,099", "thread_id": "10056", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001ff8" }, { "name": "DesiredAccess", "value": "0x00120080", "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\Volume{528c102f-0000-0000-0000-300300000000}" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3047 }, { "timestamp": "2026-05-28 23:35:09,099", "thread_id": "10056", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbb6cf5ccf", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xffffffff" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000230c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 3048 }, { "timestamp": "2026-05-28 23:35:09,099", "thread_id": "10056", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbb6cf5ccf", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xffffffff" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001ff8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 3049 }, { "timestamp": "2026-05-28 23:35:09,099", "thread_id": "10056", "caller": "0x7ffbb6cf6ced", "parentcaller": "0x7ffbb6cf816c", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "A463FCB9-6B1C-4E0D-A80B-A2CA7999E25D" }, { "name": "ClsContext", "value": "0x00100004", "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_ENABLE_CLOAKING" }, { "name": "riid", "value": "00000001-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3050 }, { "timestamp": "2026-05-28 23:35:09,115", "thread_id": "8944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 2, "id": 3051 }, { "timestamp": "2026-05-28 23:35:09,131", "thread_id": "10056", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002380" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10580000" }, { "name": "SectionOffset", "value": "0x1128c510" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3052 }, { "timestamp": "2026-05-28 23:35:09,131", "thread_id": "10056", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc282a36b", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000237c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 3053 }, { "timestamp": "2026-05-28 23:35:09,131", "thread_id": "10056", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc2849362", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000263c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 3054 }, { "timestamp": "2026-05-28 23:35:09,131", "thread_id": "10056", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc219c2ff", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002458" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 3055 }, { "timestamp": "2026-05-28 23:35:09,131", "thread_id": "2404", "caller": "0x7ff627679d60", "parentcaller": "0x7ff627679c74", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 3056 }, { "timestamp": "2026-05-28 23:35:09,271", "thread_id": "4744", "caller": "0x7ffbaf96e842", "parentcaller": "0x7ffbc7bc16e9", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002610" }, { "name": "DesiredAccess", "value": "0x00120089", "pretty_value": "FILE_GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\Bam" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 3057 }, { "timestamp": "2026-05-28 23:35:09,287", "thread_id": "4744", "caller": "0x7ffbc649b8ed", "parentcaller": "0x7ffbc5c46d18", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000e7c", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffbc5c4be80" }, { "name": "Parameter", "value": "0x08d7d410" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "9172" }, { "name": "ProcessId", "value": "4692" } ], "repeated": 0, "id": 3058 }, { "timestamp": "2026-05-28 23:35:09,287", "thread_id": "9172", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc544e6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "D3D10Warp.dll" }, { "name": "BaseAddress", "value": "0x7ffbbdd10000" } ], "repeated": 0, "id": 3059 }, { "timestamp": "2026-05-28 23:35:09,287", "thread_id": "9172", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc544e6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "gdi32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc6d10000" } ], "repeated": 1, "id": 3060 }, { "timestamp": "2026-05-28 23:35:09,287", "thread_id": "9172", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc3b01bd0", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "d3d10warp.dll" }, { "name": "BaseAddress", "value": "0x7ffbbdd10000" } ], "repeated": 0, "id": 3061 }, { "timestamp": "2026-05-28 23:35:09,287", "thread_id": "9172", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455f3e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000025e4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\explorer.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3062 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "9172", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000f9c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\d3d10warp.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3063 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "9172", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc282a36b", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000f9c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 3064 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "9172", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc2849362", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00002bcc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 3065 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "9172", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbc1ebe2ba", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x11290000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3066 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "9172", "caller": "0x7ffbc5c3f55f", "parentcaller": "0x7ffbc5c2705e", "category": "system", "api": "SetWindowsHookExW", "status": true, "return": "0x00510445", "arguments": [ { "name": "HookIdentifier", "value": "4", "pretty_value": "WH_CALLWNDPROC" }, { "name": "ProcedureAddress", "value": "0x7ffbc5c3fa40" }, { "name": "ModuleAddress", "value": "0x7ffbc5c20000" }, { "name": "ThreadId", "value": "9172" } ], "repeated": 0, "id": 3067 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "9172", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc703ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000928" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 3068 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "5836", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x114b0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3069 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "5836", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7560000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3070 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "5836", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059db5", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7560000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3071 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "5836", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059f77", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7560000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3072 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "5836", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059f77", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7561000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x40000020", "pretty_value": "PAGE_EXECUTE_READ|0x40000000" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3073 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "9172", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x114b0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3074 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "5836", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f347000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3075 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "9172", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x114c0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3076 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "9172", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f350000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3077 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "5836", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f359000" }, { "name": "RegionSize", "value": "0x0000c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3078 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "5836", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x11650000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3079 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "5836", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x11670000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3080 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "9172", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x11680000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3081 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "5836", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x11690000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3082 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "5068", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x116a0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3083 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "5068", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x116b0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3084 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "5836", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7550000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3085 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "5836", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059db5", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7550000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3086 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "9172", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000008e8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x116d0000" }, { "name": "SectionOffset", "value": "0x117af260" }, { "name": "ViewSize", "value": "0x00004000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3087 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "5068", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7540000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3088 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "9172", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000008e8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x117b0000" }, { "name": "SectionOffset", "value": "0x117af710" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3089 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "5068", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059db5", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7540000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3090 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "5068", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059f77", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7540000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3091 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "9172", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002aac" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x117b0000" }, { "name": "SectionOffset", "value": "0x117af7d0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3092 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "9172", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002aac" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x117b0000" }, { "name": "SectionOffset", "value": "0x117af7d0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3093 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "9172", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a90" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x117b0000" }, { "name": "SectionOffset", "value": "0x117af940" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3094 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "5044", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002ae8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x117c0000" }, { "name": "SectionOffset", "value": "0x07eaf240" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3095 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "9172", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a90" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x117b0000" }, { "name": "SectionOffset", "value": "0x117af810" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3096 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "9172", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a90" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x117b0000" }, { "name": "SectionOffset", "value": "0x117af810" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3097 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "5044", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002ae8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x117b0000" }, { "name": "SectionOffset", "value": "0x07eaf240" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3098 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "9172", "caller": "0x7ffbc649b8ed", "parentcaller": "0x7ffbabdffd42", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x0000091c", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffbabde5100" }, { "name": "Parameter", "value": "0x7ffbac056038" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "8564" }, { "name": "ProcessId", "value": "4692" } ], "repeated": 0, "id": 3099 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "5836", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059f77", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7551000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x40000020", "pretty_value": "PAGE_EXECUTE_READ|0x40000000" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3100 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "5068", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059f77", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7541000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x40000020", "pretty_value": "PAGE_EXECUTE_READ|0x40000000" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3101 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "5836", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f365000" }, { "name": "RegionSize", "value": "0x000c9000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3102 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc703ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000918" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 3103 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "2956", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f42e000" }, { "name": "RegionSize", "value": "0x000c9000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3104 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "5836", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f4f7000" }, { "name": "RegionSize", "value": "0x00036000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3105 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "5068", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f52d000" }, { "name": "RegionSize", "value": "0x0000c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3106 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "5068", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x11650000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3107 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "5068", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x11670000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3108 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "5068", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7530000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3109 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "5068", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059db5", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7530000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3110 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "5068", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059f77", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7530000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3111 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "5068", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059f77", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7531000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x40000020", "pretty_value": "PAGE_EXECUTE_READ|0x40000000" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3112 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll\\5" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3113 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002384" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3114 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6c349", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002384" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3115 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b3a6", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002384" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x08\\x01\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3116 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b477", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002384" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3117 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b649", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002384" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3118 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002384" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3119 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002384" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3120 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002384" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xae\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3121 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002384" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3122 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002384" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3123 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002384" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3124 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002384" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3125 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002384" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3126 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "9172", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f539000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3127 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "9172", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f54a000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3128 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002384" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3129 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002384" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3130 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002384" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x90\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3131 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b8c3", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002384" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa0\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3132 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002384" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3133 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002384" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x08\\xfe)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3134 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002384" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3135 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b585", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002384" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3136 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002ae8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x11650000" }, { "name": "SectionOffset", "value": "0x11a7e260" }, { "name": "ViewSize", "value": "0x0000c000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3137 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f24" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\stdole2.tlb" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3138 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6c349", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f24" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\stdole2.tlb" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3139 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b3a6", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f24" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\stdole2.tlb" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3140 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b477", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f24" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\stdole2.tlb" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xb0\\x01\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3141 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b649", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f24" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\stdole2.tlb" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3142 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f24" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\stdole2.tlb" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3143 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f24" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\stdole2.tlb" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\x04\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3144 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f24" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\stdole2.tlb" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xf8\\x04\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3145 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f24" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\stdole2.tlb" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\x04\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3146 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f24" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\stdole2.tlb" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\x04\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3147 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f24" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\stdole2.tlb" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xe8\\x04\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3148 }, { "timestamp": "2026-05-28 23:35:09,302", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f24" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\stdole2.tlb" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\x04\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3149 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f24" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\stdole2.tlb" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3150 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f24" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\stdole2.tlb" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "@\\x04\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3151 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b8c3", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f24" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\stdole2.tlb" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "P\\x04\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3152 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "9172", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x116a0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3153 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f24" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\stdole2.tlb" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3154 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "9172", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc1c15dbb", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001f54" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000027ac" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 3155 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b649", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f24" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\stdole2.tlb" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3156 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f24" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\stdole2.tlb" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x88\\x04\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3157 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "5068", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f55b000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3158 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "5068", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x116b0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3159 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "5068", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x117b0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3160 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f24" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\stdole2.tlb" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3161 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b585", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f24" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\stdole2.tlb" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xc8\\x04\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3162 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002970" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x117c0000" }, { "name": "SectionOffset", "value": "0x11a7de30" }, { "name": "ViewSize", "value": "0x00004000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3163 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "5068", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059ad1", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7520000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3164 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "5068", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059db5", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7520000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3165 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "5068", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059f77", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7520000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3166 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "5068", "caller": "0x7ffbc5474448", "parentcaller": "0x7ffbbe059f77", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7df4c7521000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x40000020", "pretty_value": "PAGE_EXECUTE_READ|0x40000000" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3167 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "4732", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f56c000" }, { "name": "RegionSize", "value": "0x00036000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3168 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll\\5" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3169 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3170 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "9172", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a26a000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3171 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "9172", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0a279000" }, { "name": "RegionSize", "value": "0x0001b000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3172 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6c349", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3173 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b3a6", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x08\\x01\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3174 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "4744", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc34258d4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 3175 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b477", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3176 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b649", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3177 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3178 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3179 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xae\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3180 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3181 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3182 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3183 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3184 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3185 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "p\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3186 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3187 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3188 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x90\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3189 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b8c3", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa0\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3190 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3191 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x08\\xfe)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3192 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3193 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b585", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a58" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3194 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a54" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10580000" }, { "name": "SectionOffset", "value": "0x0901d9d0" }, { "name": "ViewSize", "value": "0x0000c000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3195 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll\\5" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3196 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a54" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3197 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6c349", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3198 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b3a6", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x08\\x01\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3199 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b477", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3200 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b649", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3201 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3202 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3203 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xae\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3204 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3205 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3206 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3207 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3208 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3209 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "p\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3210 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3211 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3212 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x90\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3213 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b8c3", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa0\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3214 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3215 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x08\\xfe)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3216 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3217 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b585", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3218 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8564", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a58" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10580000" }, { "name": "SectionOffset", "value": "0x11a7e260" }, { "name": "ViewSize", "value": "0x0000c000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3219 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll\\5" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3220 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3221 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6c349", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3222 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b3a6", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x08\\x01\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3223 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b477", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3224 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b649", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3225 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3226 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3227 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xae\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3228 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3229 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3230 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3231 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3232 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3233 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "p\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3234 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3235 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3236 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x90\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3237 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b8c3", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa0\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3238 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3239 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x08\\xfe)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3240 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3241 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b585", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3242 }, { "timestamp": "2026-05-28 23:35:09,318", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a18" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10580000" }, { "name": "SectionOffset", "value": "0x0901d9d0" }, { "name": "ViewSize", "value": "0x0000c000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3243 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll\\5" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3244 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002974" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3245 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6c349", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002974" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3246 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b3a6", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002974" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x08\\x01\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3247 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b477", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002974" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3248 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b649", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002974" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3249 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002974" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3250 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002974" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3251 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002974" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xae\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3252 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002974" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3253 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002974" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3254 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002974" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3255 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002974" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3256 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002974" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3257 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002974" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "p\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3258 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002974" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3259 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002974" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3260 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002974" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x90\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3261 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b8c3", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002974" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa0\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3262 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002974" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3263 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002974" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x08\\xfe)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3264 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002974" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3265 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b585", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002974" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3266 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a50" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10580000" }, { "name": "SectionOffset", "value": "0x11a7e260" }, { "name": "ViewSize", "value": "0x0000c000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3267 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll\\5" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3268 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3269 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6c349", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3270 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b3a6", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x08\\x01\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3271 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b477", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3272 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b649", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3273 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3274 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3275 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xae\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3276 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3277 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3278 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3279 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3280 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3281 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "p\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3282 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3283 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3284 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x90\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3285 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b8c3", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa0\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3286 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3287 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x08\\xfe)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3288 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3289 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b585", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3290 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a34" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10580000" }, { "name": "SectionOffset", "value": "0x0901d9d0" }, { "name": "ViewSize", "value": "0x0000c000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3291 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll\\5" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3292 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f3c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3293 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6c349", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f3c" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3294 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b3a6", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f3c" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x08\\x01\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3295 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b477", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f3c" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3296 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b649", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f3c" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3297 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f3c" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3298 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f3c" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3299 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f3c" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xae\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3300 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f3c" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3301 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f3c" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3302 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f3c" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3303 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f3c" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3304 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f3c" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3305 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f3c" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "p\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3306 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f3c" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3307 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f3c" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3308 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f3c" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x90\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3309 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b8c3", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f3c" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa0\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3310 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f3c" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3311 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f3c" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x08\\xfe)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3312 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f3c" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3313 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b585", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f3c" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3314 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8564", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001f24" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10580000" }, { "name": "SectionOffset", "value": "0x11a7e260" }, { "name": "ViewSize", "value": "0x0000c000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3315 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll\\5" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3316 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3317 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6c349", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3318 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b3a6", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x08\\x01\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3319 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b477", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3320 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b649", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3321 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3322 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3323 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xae\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3324 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3325 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3326 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3327 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3328 }, { "timestamp": "2026-05-28 23:35:09,334", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3329 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "p\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3330 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3331 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3332 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x90\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3333 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b8c3", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa0\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3334 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3335 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x08\\xfe)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3336 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3337 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b585", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002984" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3338 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a18" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10580000" }, { "name": "SectionOffset", "value": "0x0901d9d0" }, { "name": "ViewSize", "value": "0x0000c000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3339 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll\\5" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3340 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f54" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3341 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6c349", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3342 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b3a6", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x08\\x01\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3343 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b477", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3344 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b649", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3345 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3346 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3347 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xae\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3348 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3349 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3350 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3351 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3352 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3353 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "p\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3354 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3355 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3356 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x90\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3357 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b8c3", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa0\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3358 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3359 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x08\\xfe)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3360 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3361 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b585", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001f54" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3362 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000027ac" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10580000" }, { "name": "SectionOffset", "value": "0x11a7e260" }, { "name": "ViewSize", "value": "0x0000c000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3363 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll\\5" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3364 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a60" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3365 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6c349", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a60" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3366 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b3a6", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a60" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x08\\x01\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3367 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b477", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a60" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3368 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b649", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a60" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3369 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a60" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3370 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a60" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3371 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a60" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xae\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3372 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a60" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3373 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a60" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3374 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a60" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3375 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a60" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3376 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a60" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3377 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a60" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "p\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3378 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a60" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3379 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a60" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3380 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a60" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x90\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3381 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b8c3", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a60" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa0\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3382 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a60" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3383 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a60" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x08\\xfe)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3384 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a60" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3385 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b585", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a60" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3386 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a50" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10580000" }, { "name": "SectionOffset", "value": "0x0901d9d0" }, { "name": "ViewSize", "value": "0x0000c000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3387 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll\\5" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3388 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a64" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3389 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6c349", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a64" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3390 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b3a6", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a64" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x08\\x01\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3391 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b477", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a64" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3392 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b649", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a64" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3393 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a64" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3394 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a64" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3395 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a64" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xae\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3396 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a64" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3397 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a64" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3398 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a64" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3399 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a64" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3400 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a64" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3401 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a64" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "p\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3402 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a64" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3403 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a64" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3404 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a64" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x90\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3405 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b8c3", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a64" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa0\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3406 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a64" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3407 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a64" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x08\\xfe)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3408 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a64" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3409 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b585", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a64" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3410 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8564", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002984" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10580000" }, { "name": "SectionOffset", "value": "0x11a7e260" }, { "name": "ViewSize", "value": "0x0000c000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3411 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll\\5" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3412 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3413 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6c349", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3414 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b3a6", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x08\\x01\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3415 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b477", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3416 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b649", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3417 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3418 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3419 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xae\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3420 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x18\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3421 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3422 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x80\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3423 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3424 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7ba", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3425 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b7e2", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "p\\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3426 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b82b", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "(\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3427 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3428 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x90\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3429 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b8c3", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa0\\xfc)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3430 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 3431 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b67a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x08\\xfe)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3432 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b71f", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3433 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc5473013", "parentcaller": "0x7ffbc6e6b585", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00002a38" }, { "name": "HandleName", "value": "C:\\Windows\\System32\\UIAutomationCore.dll" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": " \\xff)\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3434 }, { "timestamp": "2026-05-28 23:35:09,349", "thread_id": "8944", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00002a44" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10580000" }, { "name": "SectionOffset", "value": "0x0901d9d0" }, { "name": "ViewSize", "value": "0x0000c000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3435 }, { "timestamp": "2026-05-28 23:35:09,365", "thread_id": "9172", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000027ac" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10580000" }, { "name": "SectionOffset", "value": "0x117ae8b0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3436 }, { "timestamp": "2026-05-28 23:35:09,365", "thread_id": "9172", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c232", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000008e8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x10580000" }, { "name": "SectionOffset", "value": "0x117ae710" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3437 }, { "timestamp": "2026-05-28 23:35:09,365", "thread_id": "9172", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0f5a2000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3438 } ], "threads": [ "4696", "5044", "7540", "4824", "5824", "4864", "4828", "5836", "4944", "5244", "5140", "5816", "5144", "3700", "4644", "6052", "4832", "4732", "4188", "5008", "4744", "4788", "5856", "5832", "2404", "5852", "5260", "4748", "3100", "4868", "5020", "8988", "8944", "5860", "8884", "9036", "8888", "8728", "8784", "4708", "10056", "9172", "5068", "8564", "2956" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "C:\\Windows\\Explorer.EXE", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff627610000", "MainExeSize": "0x00546000", "Bitness": "64-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } }, { "process_id": 5704, "process_name": "msedge.exe", "parent_id": 4692, "module_path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", "first_seen": "2026-05-28 23:34:26,843", "calls": [ { "timestamp": "2026-05-28 23:34:27,031", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\bcryptprimitives" }, { "name": "DllBase", "value": "0x7ffbc5750000" } ], "repeated": 0, "id": 0 }, { "timestamp": "2026-05-28 23:34:27,031", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\version" }, { "name": "DllBase", "value": "0x7ffbb4f50000" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-05-28 23:34:27,031", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x7ffbc5c20000" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-05-28 23:34:27,031", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x7ffbc5c20000" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-05-28 23:34:27,031", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Wldp" }, { "name": "DllBase", "value": "0x7ffbc4bf0000" } ], "repeated": 0, "id": 4 }, { "timestamp": "2026-05-28 23:34:27,031", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\windows.storage" }, { "name": "DllBase", "value": "0x7ffbc3310000" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-05-28 23:34:27,031", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\SHCORE" }, { "name": "DllBase", "value": "0x7ffbc5c20000" } ], "repeated": 0, "id": 6 }, { "timestamp": "2026-05-28 23:34:27,031", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7ffbc4350000" } ], "repeated": 0, "id": 7 }, { "timestamp": "2026-05-28 23:34:27,281", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WINMM" }, { "name": "DllBase", "value": "0x7ffbb35a0000" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-05-28 23:34:27,281", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge" }, { "name": "DllBase", "value": "0x7ffb71750000" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-05-28 23:34:27,296", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\KBDUS" }, { "name": "DllBase", "value": "0x7ffbb33a0000" } ], "repeated": 0, "id": 10 }, { "timestamp": "2026-05-28 23:34:27,296", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\KBDUS" }, { "name": "DllBase", "value": "0x7ffbb33a0000" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-05-28 23:34:27,296", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\uxtheme" }, { "name": "DllBase", "value": "0x7ffbc2bf0000" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-05-28 23:34:27,296", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\kernel.appcore" }, { "name": "DllBase", "value": "0x7ffbc3110000" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-05-28 23:34:27,296", "thread_id": "3080", "caller": "0x7ffbc547c5f2", "parentcaller": "0x7ffbc54789f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000037c" }, { "name": "ThreadHandle", "value": "0x00000378" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=crashpad-handler \"--user-data-dir=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=148.0.7778.180 \"--annotation=exe=C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=148.0.3967.83 --initial-client-data=0x354,0x358,0x35c,0x34c,0x364,0x7ffb85295d58,0x7ffb85295d64,0x7ffb85295d70" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "4136" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-05-28 23:34:27,296", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\clbcatq" }, { "name": "DllBase", "value": "0x7ffbc7a60000" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-05-28 23:34:27,296", "thread_id": "3080", "caller": "0x7ffbc54789f3", "parentcaller": "0x7ffbc65b7d70", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=crashpad-handler \"--user-data-dir=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=148.0.7778.180 \"--annotation=exe=C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=148.0.3967.83 --initial-client-data=0x354,0x358,0x35c,0x34c,0x364,0x7ffb85295d58,0x7ffb85295d64,0x7ffb85295d70" }, { "name": "CreationFlags", "value": "0x00080000", "pretty_value": "EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "4136" }, { "name": "ThreadId", "value": "3420" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x0000037c" }, { "name": "ThreadHandle", "value": "0x00000378" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-05-28 23:34:27,296", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings" }, { "name": "DllBase", "value": "0x7ffbb1aa0000" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-05-28 23:34:27,296", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7ffbc42c0000" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-05-28 23:34:27,296", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7ffbbf330000" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-05-28 23:34:27,312", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7ffbbf330000" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-05-28 23:34:27,312", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7ffbc42c0000" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-05-28 23:34:27,312", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\USERENV" }, { "name": "DllBase", "value": "0x7ffbc5120000" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-05-28 23:34:27,312", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\gpapi" }, { "name": "DllBase", "value": "0x7ffbc3ac0000" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-05-28 23:34:27,312", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\wkscli" }, { "name": "DllBase", "value": "0x7ffbc4390000" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-05-28 23:34:27,312", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\netutils" }, { "name": "DllBase", "value": "0x7ffbc4700000" } ], "repeated": 0, "id": 25 }, { "timestamp": "2026-05-28 23:34:27,312", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7ffbc42c0000" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-05-28 23:34:27,312", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\MDMRegistration" }, { "name": "DllBase", "value": "0x7ffbad7d0000" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-05-28 23:34:27,312", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7ffbc4fe0000" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-05-28 23:34:27,312", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\CRYPTSP" }, { "name": "DllBase", "value": "0x7ffbc4af0000" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-05-28 23:34:27,312", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ncrypt" }, { "name": "DllBase", "value": "0x7ffbc4c60000" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-05-28 23:34:27,312", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x7ffbc6800000" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-05-28 23:34:27,312", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\tbs" }, { "name": "DllBase", "value": "0x7ffbbce20000" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-05-28 23:34:27,312", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DMCmnUtils" }, { "name": "DllBase", "value": "0x7ffbad720000" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-05-28 23:34:27,328", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\omadmapi" }, { "name": "DllBase", "value": "0x7ffbad950000" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-05-28 23:34:27,328", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\UMPDC" }, { "name": "DllBase", "value": "0x7ffbc4fc0000" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-05-28 23:34:27,328", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\NTASN1" }, { "name": "DllBase", "value": "0x7ffbc4c20000" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-05-28 23:34:27,328", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\MDMRegistration" }, { "name": "DllBase", "value": "0x7ffbad7d0000" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-05-28 23:34:27,328", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\omadmapi" }, { "name": "DllBase", "value": "0x7ffbad950000" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-05-28 23:34:27,328", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7ffbc42c0000" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-05-28 23:34:27,328", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7ffbc4fe0000" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-05-28 23:34:27,328", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\UMPDC" }, { "name": "DllBase", "value": "0x7ffbc4fc0000" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-05-28 23:34:27,328", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DMCmnUtils" }, { "name": "DllBase", "value": "0x7ffbad720000" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-05-28 23:34:27,328", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\CRYPTSP" }, { "name": "DllBase", "value": "0x7ffbc4af0000" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-05-28 23:34:27,328", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ncrypt" }, { "name": "DllBase", "value": "0x7ffbc4c60000" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-05-28 23:34:27,328", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\NTASN1" }, { "name": "DllBase", "value": "0x7ffbc4c20000" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-05-28 23:34:27,328", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\tbs" }, { "name": "DllBase", "value": "0x7ffbbce20000" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-05-28 23:34:27,328", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x7ffbc6800000" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-05-28 23:34:27,328", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\netapi32" }, { "name": "DllBase", "value": "0x7ffbb3170000" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-05-28 23:34:27,328", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7ffbc42c0000" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-05-28 23:34:27,328", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\cryptsp" }, { "name": "DllBase", "value": "0x7ffbc4af0000" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-05-28 23:34:27,328", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DSREG" }, { "name": "DllBase", "value": "0x7ffbc0f30000" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-05-28 23:34:27,328", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\profapi" }, { "name": "DllBase", "value": "0x7ffbc5160000" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-05-28 23:34:27,328", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\netapi32" }, { "name": "DllBase", "value": "0x7ffbb3170000" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-05-28 23:34:27,328", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DSREG" }, { "name": "DllBase", "value": "0x7ffbc0f30000" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-05-28 23:34:27,328", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7ffbc42c0000" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-05-28 23:34:27,328", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\cryptsp" }, { "name": "DllBase", "value": "0x7ffbc4af0000" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-05-28 23:34:27,343", "thread_id": "8224", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\AssignedAccessRuntime" }, { "name": "DllBase", "value": "0x7ffbad970000" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-05-28 23:34:27,343", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\MSCTF" }, { "name": "DllBase", "value": "0x7ffbc7690000" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-05-28 23:34:27,343", "thread_id": "8224", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\SystemSettings.DataModel" }, { "name": "DllBase", "value": "0x7ffbba6f0000" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-05-28 23:34:27,343", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7ffbc4fe0000" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-05-28 23:34:27,343", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\UMPDC" }, { "name": "DllBase", "value": "0x7ffbc4fc0000" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-05-28 23:34:27,343", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DWrite" }, { "name": "DllBase", "value": "0x7ffbb7f30000" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-05-28 23:34:27,343", "thread_id": "8280", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub" }, { "name": "DllBase", "value": "0x7ffbbe780000" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-05-28 23:34:27,343", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\\COMCTL32" }, { "name": "DllBase", "value": "0x7ffbb1750000" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-05-28 23:34:27,343", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DPAPI" }, { "name": "DllBase", "value": "0x7ffbc4fb0000" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-05-28 23:34:27,343", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\IPHLPAPI" }, { "name": "DllBase", "value": "0x7ffbc45f0000" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-05-28 23:34:27,343", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\NLAapi" }, { "name": "DllBase", "value": "0x7ffbc09b0000" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-05-28 23:34:27,343", "thread_id": "8264", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\CFGMGR32" }, { "name": "DllBase", "value": "0x7ffbc58e0000" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-05-28 23:34:27,359", "thread_id": "8304", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\StructuredQuery" }, { "name": "DllBase", "value": "0x7ffbb9b80000" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-05-28 23:34:27,359", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\NSI" }, { "name": "DllBase", "value": "0x7ffbc6cf0000" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-05-28 23:34:27,359", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\dhcpcsvc6" }, { "name": "DllBase", "value": "0x7ffbbefd0000" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-05-28 23:34:27,359", "thread_id": "8304", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\PROPSYS" }, { "name": "DllBase", "value": "0x7ffbc0db0000" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-05-28 23:34:27,359", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\dhcpcsvc" }, { "name": "DllBase", "value": "0x7ffbbdc90000" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-05-28 23:34:27,359", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DNSAPI" }, { "name": "DllBase", "value": "0x7ffbc4630000" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-05-28 23:34:27,359", "thread_id": "8348", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.StateRepositoryPS" }, { "name": "DllBase", "value": "0x7ffbb5d90000" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-05-28 23:34:27,359", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\CoreMessaging" }, { "name": "DllBase", "value": "0x7ffbc2820000" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-05-28 23:34:27,359", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\wintypes" }, { "name": "DllBase", "value": "0x7ffbc1080000" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-05-28 23:34:27,359", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\CoreUIComponents" }, { "name": "DllBase", "value": "0x7ffbc2140000" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-05-28 23:34:27,359", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\textinputframework" }, { "name": "DllBase", "value": "0x7ffbb9560000" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-05-28 23:34:27,359", "thread_id": "8304", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\Windows.Storage.Search" }, { "name": "DllBase", "value": "0x7ffbb5ca0000" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-05-28 23:34:27,375", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\twinapi.appcore" }, { "name": "DllBase", "value": "0x7ffbbf7e0000" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-05-28 23:34:27,375", "thread_id": "8348", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\mssprxy" }, { "name": "DllBase", "value": "0x7ffbb55b0000" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-05-28 23:34:27,375", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\twinapi" }, { "name": "DllBase", "value": "0x7ffbb1ae0000" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-05-28 23:34:27,375", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\wevtapi" }, { "name": "DllBase", "value": "0x7ffbbf690000" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-05-28 23:34:27,375", "thread_id": "8280", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\edputil" }, { "name": "DllBase", "value": "0x7ffbb5200000" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-05-28 23:34:27,375", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\WindowManagementAPI" }, { "name": "DllBase", "value": "0x7ffbbfb00000" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-05-28 23:34:27,390", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\InputHost" }, { "name": "DllBase", "value": "0x7ffbb9400000" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-05-28 23:34:27,390", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.UI" }, { "name": "DllBase", "value": "0x7ffbb9660000" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-05-28 23:34:27,390", "thread_id": "8224", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\iertutil" }, { "name": "DllBase", "value": "0x7ffbb9f00000" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-05-28 23:34:27,390", "thread_id": "8224", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.Web" }, { "name": "DllBase", "value": "0x7ffbb5110000" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-05-28 23:34:27,390", "thread_id": "8364", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WTSAPI32" }, { "name": "DllBase", "value": "0x7ffbc0ee0000" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-05-28 23:34:27,390", "thread_id": "8224", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ColorAdapterClient" }, { "name": "DllBase", "value": "0x7ffbbf590000" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-05-28 23:34:27,390", "thread_id": "8224", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\mscms" }, { "name": "DllBase", "value": "0x7ffbbf5b0000" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-05-28 23:34:27,390", "thread_id": "8364", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WINSTA" }, { "name": "DllBase", "value": "0x7ffbc4b90000" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-05-28 23:34:27,406", "thread_id": "8224", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WINHTTP" }, { "name": "DllBase", "value": "0x7ffbbf9f0000" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-05-28 23:34:27,437", "thread_id": "8232", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\oneauth" }, { "name": "DllBase", "value": "0x7ffb6fdf0000" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-05-28 23:34:27,437", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.UI.Immersive" }, { "name": "DllBase", "value": "0x7ffbb81b0000" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-05-28 23:34:27,437", "thread_id": "8464", "caller": "0x7ffbc547c5f2", "parentcaller": "0x7ffbc5479666", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000a28" }, { "name": "ThreadHandle", "value": "0x00000a24" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=2412,i,9254761530843504222,7616292111383238981,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2588 /prefetch:3" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "8524" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-05-28 23:34:27,453", "thread_id": "8232", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Secur32" }, { "name": "DllBase", "value": "0x7ffbb6910000" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-05-28 23:34:27,453", "thread_id": "8464", "caller": "0x7ffbc5479666", "parentcaller": "0x7ffbc649cec4", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=2412,i,9254761530843504222,7616292111383238981,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2588 /prefetch:3" }, { "name": "CreationFlags", "value": "0x00080000", "pretty_value": "EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "8524" }, { "name": "ThreadId", "value": "8528" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00000a28" }, { "name": "ThreadHandle", "value": "0x00000a24" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-05-28 23:34:27,453", "thread_id": "8224", "caller": "0x7ff66c4a7d66", "parentcaller": "0x7ff66c4a81c2", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000009f8" }, { "name": "ThreadHandle", "value": "0x000009dc" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2172,i,4642495680772319387,17118116984640679203,262144 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2312 /prefetch:2" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "8560" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-05-28 23:34:27,453", "thread_id": "8216", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\sxs" }, { "name": "DllBase", "value": "0x7ffbc5030000" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-05-28 23:34:27,453", "thread_id": "8432", "caller": "0x7ff66c4a7d66", "parentcaller": "0x7ff66c4a81c2", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000af8" }, { "name": "ThreadHandle", "value": "0x00000ae8" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2672,i,15125762378853465392,758582465602508720,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2676 /prefetch:8" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "8604" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-05-28 23:34:27,468", "thread_id": "8224", "caller": "0x7ff66c4a7d66", "parentcaller": "0x7ff66c4a81c2", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2172,i,4642495680772319387,17118116984640679203,262144 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2312 /prefetch:2" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "8560" }, { "name": "ThreadId", "value": "8564" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x000009f8" }, { "name": "ThreadHandle", "value": "0x000009dc" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-05-28 23:34:27,468", "thread_id": "8428", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\LINKINFO" }, { "name": "DllBase", "value": "0x7ffbb4f60000" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-05-28 23:34:27,484", "thread_id": "8432", "caller": "0x7ff66c4a7d66", "parentcaller": "0x7ff66c4a81c2", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2672,i,15125762378853465392,758582465602508720,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2676 /prefetch:8" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "8604" }, { "name": "ThreadId", "value": "8608" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00000af8" }, { "name": "ThreadHandle", "value": "0x00000ae8" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-05-28 23:34:27,484", "thread_id": "8216", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\usermgrcli" }, { "name": "DllBase", "value": "0x7ffbc0580000" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-05-28 23:34:27,500", "thread_id": "8216", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.Internal.UI.Shell.WindowTabManager" }, { "name": "DllBase", "value": "0x7ffbae420000" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-05-28 23:34:27,562", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dxgi" }, { "name": "DllBase", "value": "0x7ffbc3af0000" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-05-28 23:34:27,562", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\d3d11" }, { "name": "DllBase", "value": "0x7ffbc1c00000" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-05-28 23:34:27,562", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcomp" }, { "name": "DllBase", "value": "0x7ffbc1e70000" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-05-28 23:34:27,562", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dataexchange" }, { "name": "DllBase", "value": "0x7ffbb1d70000" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-05-28 23:34:27,593", "thread_id": "8224", "caller": "0x7ff66c4a7d66", "parentcaller": "0x7ff66c4a81c2", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.System.Profile.RetailInfo" }, { "name": "DllBase", "value": "0x7ffbad7d0000" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-05-28 23:34:27,609", "thread_id": "8216", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\dwmapi" }, { "name": "DllBase", "value": "0x7ffbc2d40000" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-05-28 23:34:27,609", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\OLEACC" }, { "name": "DllBase", "value": "0x7ffbb0fd0000" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-05-28 23:34:27,609", "thread_id": "8232", "caller": "0x7ff66c4a7d66", "parentcaller": "0x7ff66c4a81c2", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000e68" }, { "name": "ThreadHandle", "value": "0x00000e98" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780011216982031 --launch-time-ticks=50635969 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3584,i,14196480617990583521,17268836115555013304,2097152 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3596 /prefetch:1" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "8900" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-05-28 23:34:27,609", "thread_id": "8268", "caller": "0x7ff66c4a7d66", "parentcaller": "0x7ff66c4a81c2", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000e9c" }, { "name": "ThreadHandle", "value": "0x00000e7c" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780011216982031 --launch-time-ticks=50638248 --skip-read-main-dll --metrics-shmem-handle=3612,i,13922137629094413072,6799869366371709248,2097152 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3696 /prefetch:1" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "8908" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-05-28 23:34:27,609", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\directmanipulation" }, { "name": "DllBase", "value": "0x7ffbb6c40000" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-05-28 23:34:27,609", "thread_id": "8232", "caller": "0x7ff66c4a7d66", "parentcaller": "0x7ff66c4a81c2", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780011216982031 --launch-time-ticks=50635969 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3584,i,14196480617990583521,17268836115555013304,2097152 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3596 /prefetch:1" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "8900" }, { "name": "ThreadId", "value": "8904" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00000e68" }, { "name": "ThreadHandle", "value": "0x00000e98" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 119 }, { "timestamp": "2026-05-28 23:34:27,609", "thread_id": "8268", "caller": "0x7ff66c4a7d66", "parentcaller": "0x7ff66c4a81c2", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780011216982031 --launch-time-ticks=50638248 --skip-read-main-dll --metrics-shmem-handle=3612,i,13922137629094413072,6799869366371709248,2097152 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3696 /prefetch:1" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "8908" }, { "name": "ThreadId", "value": "8912" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00000e9c" }, { "name": "ThreadHandle", "value": "0x00000e7c" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-05-28 23:34:27,734", "thread_id": "9080", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.Security.Authentication.Web.Core" }, { "name": "DllBase", "value": "0x7ffbb2fe0000" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-05-28 23:34:27,734", "thread_id": "8348", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\OneCoreCommonProxyStub" }, { "name": "DllBase", "value": "0x7ffbb6e10000" } ], "repeated": 0, "id": 122 }, { "timestamp": "2026-05-28 23:34:27,750", "thread_id": "8432", "caller": "0x7ff66c4a7d66", "parentcaller": "0x7ff66c4a81c2", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Well Known Domains\\1.2.0.0\\well_known_domains" }, { "name": "DllBase", "value": "0x7ffbad430000" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-05-28 23:34:27,750", "thread_id": "8348", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\vaultcli" }, { "name": "DllBase", "value": "0x7ffba7ae0000" } ], "repeated": 0, "id": 124 }, { "timestamp": "2026-05-28 23:34:27,750", "thread_id": "8224", "caller": "0x7ff66c4a7d66", "parentcaller": "0x7ff66c4a81c2", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\MSASN1" }, { "name": "DllBase", "value": "0x7ffbc4d80000" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-05-28 23:34:27,765", "thread_id": "8224", "caller": "0x7ff66c4a7d66", "parentcaller": "0x7ff66c4a81c2", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\CRYPTSP" }, { "name": "DllBase", "value": "0x7ffbc4af0000" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-05-28 23:34:27,765", "thread_id": "8224", "caller": "0x7ff66c4a7d66", "parentcaller": "0x7ff66c4a81c2", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\rsaenh" }, { "name": "DllBase", "value": "0x7ffbc4230000" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-05-28 23:34:27,812", "thread_id": "8324", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\MicrosoftAccountWAMExtension" }, { "name": "DllBase", "value": "0x7ffb6d120000" } ], "repeated": 0, "id": 128 }, { "timestamp": "2026-05-28 23:34:29,000", "thread_id": "9156", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\ShellCommonCommonProxyStub" }, { "name": "DllBase", "value": "0x7ffbad2f0000" } ], "repeated": 0, "id": 129 }, { "timestamp": "2026-05-28 23:34:29,312", "thread_id": "8232", "caller": "0x7ff66c4a7d66", "parentcaller": "0x7ff66c4a81c2", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7ffbc42c0000" } ], "repeated": 0, "id": 130 }, { "timestamp": "2026-05-28 23:34:29,312", "thread_id": "8232", "caller": "0x7ff66c4a7d66", "parentcaller": "0x7ff66c4a81c2", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7ffbbf330000" } ], "repeated": 0, "id": 131 }, { "timestamp": "2026-05-28 23:34:29,328", "thread_id": "3916", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\explorerframe" }, { "name": "DllBase", "value": "0x7ffbb0a40000" } ], "repeated": 0, "id": 132 }, { "timestamp": "2026-05-28 23:34:29,328", "thread_id": "8232", "caller": "0x7ff66c4a7d66", "parentcaller": "0x7ff66c4a81c2", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7ffbbf330000" } ], "repeated": 0, "id": 133 }, { "timestamp": "2026-05-28 23:34:29,328", "thread_id": "8232", "caller": "0x7ff66c4a7d66", "parentcaller": "0x7ff66c4a81c2", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7ffbc42c0000" } ], "repeated": 0, "id": 134 }, { "timestamp": "2026-05-28 23:34:29,343", "thread_id": "8236", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\SETUPAPI" }, { "name": "DllBase", "value": "0x7ffbc6820000" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-05-28 23:34:29,359", "thread_id": "8224", "caller": "0x7ff66c4a7d66", "parentcaller": "0x7ff66c4a81c2", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000f7c" }, { "name": "ThreadHandle", "value": "0x000014dc" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --skip-read-main-dll --metrics-shmem-handle=5208,i,5495702585828010850,3819205297865186319,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3576 /prefetch:8" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "9208" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-05-28 23:34:29,359", "thread_id": "8436", "caller": "0x7ff66c4a7d66", "parentcaller": "0x7ff66c4a81c2", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001514" }, { "name": "ThreadHandle", "value": "0x00001504" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=3960,i,4728933953316391,13056253408553037665,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3568 /prefetch:8" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "8552" } ], "repeated": 0, "id": 137 }, { "timestamp": "2026-05-28 23:34:29,359", "thread_id": "8360", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\netprofm" }, { "name": "DllBase", "value": "0x7ffbc0660000" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-05-28 23:34:29,375", "thread_id": "8436", "caller": "0x7ff66c4a7d66", "parentcaller": "0x7ff66c4a81c2", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=3960,i,4728933953316391,13056253408553037665,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3568 /prefetch:8" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "8552" }, { "name": "ThreadId", "value": "8740" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001514" }, { "name": "ThreadHandle", "value": "0x00001504" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 139 }, { "timestamp": "2026-05-28 23:34:29,375", "thread_id": "8224", "caller": "0x7ff66c4a7d66", "parentcaller": "0x7ff66c4a81c2", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --skip-read-main-dll --metrics-shmem-handle=5208,i,5495702585828010850,3819205297865186319,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3576 /prefetch:8" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "9208" }, { "name": "ThreadId", "value": "9212" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00000f7c" }, { "name": "ThreadHandle", "value": "0x000014dc" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 140 }, { "timestamp": "2026-05-28 23:34:29,375", "thread_id": "8852", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\telclient" }, { "name": "DllBase", "value": "0x7ffb6cd30000" } ], "repeated": 0, "id": 141 }, { "timestamp": "2026-05-28 23:34:29,390", "thread_id": "8268", "caller": "0x7ff66c4a7d66", "parentcaller": "0x7ff66c4a81c2", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DEVOBJ" }, { "name": "DllBase", "value": "0x7ffbc4f50000" } ], "repeated": 0, "id": 142 }, { "timestamp": "2026-05-28 23:34:29,406", "thread_id": "8360", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\npmproxy" }, { "name": "DllBase", "value": "0x7ffbbd900000" } ], "repeated": 0, "id": 143 }, { "timestamp": "2026-05-28 23:34:29,406", "thread_id": "8216", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.FileExplorer.Common" }, { "name": "DllBase", "value": "0x7ffbb0e60000" } ], "repeated": 0, "id": 144 }, { "timestamp": "2026-05-28 23:34:29,406", "thread_id": "8852", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\oneds" }, { "name": "DllBase", "value": "0x7ffb6c6d0000" } ], "repeated": 0, "id": 145 }, { "timestamp": "2026-05-28 23:34:29,406", "thread_id": "8228", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\ffmpeg" }, { "name": "DllBase", "value": "0x7ffb6f800000" } ], "repeated": 0, "id": 146 }, { "timestamp": "2026-05-28 23:34:29,421", "thread_id": "8268", "caller": "0x7ff66c4a7d66", "parentcaller": "0x7ff66c4a81c2", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\WINTRUST" }, { "name": "DllBase", "value": "0x7ffbc5930000" } ], "repeated": 0, "id": 147 }, { "timestamp": "2026-05-28 23:34:29,421", "thread_id": "8360", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\FirewallAPI" }, { "name": "DllBase", "value": "0x7ffbc3e50000" } ], "repeated": 0, "id": 148 }, { "timestamp": "2026-05-28 23:34:29,421", "thread_id": "8360", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\fwbase" }, { "name": "DllBase", "value": "0x7ffbc3e10000" } ], "repeated": 0, "id": 149 }, { "timestamp": "2026-05-28 23:34:29,421", "thread_id": "8228", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\TenantRestrictionsPlugin" }, { "name": "DllBase", "value": "0x7ffbad6f0000" } ], "repeated": 0, "id": 150 }, { "timestamp": "2026-05-28 23:34:29,421", "thread_id": "8360", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\microsoft_shell_integration" }, { "name": "DllBase", "value": "0x7ffb6c650000" } ], "repeated": 0, "id": 151 }, { "timestamp": "2026-05-28 23:34:29,421", "thread_id": "8216", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\coml2" }, { "name": "DllBase", "value": "0x7ffbc6de0000" } ], "repeated": 0, "id": 152 }, { "timestamp": "2026-05-28 23:34:29,437", "thread_id": "6212", "caller": "0x7ffbc547c5f2", "parentcaller": "0x7ffbc5479666", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000016e8" }, { "name": "ThreadHandle", "value": "0x000016ec" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5816,i,7984218614831481947,5522388298470254199,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5860 /prefetch:8" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "7488" } ], "repeated": 0, "id": 153 }, { "timestamp": "2026-05-28 23:34:29,437", "thread_id": "8360", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\RMCLIENT" }, { "name": "DllBase", "value": "0x7ffbc2f30000" } ], "repeated": 0, "id": 154 }, { "timestamp": "2026-05-28 23:34:29,453", "thread_id": "8360", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\XmlLite" }, { "name": "DllBase", "value": "0x7ffbc0d70000" } ], "repeated": 0, "id": 155 }, { "timestamp": "2026-05-28 23:34:29,453", "thread_id": "8224", "caller": "0x7ff66c4a7d66", "parentcaller": "0x7ff66c4a81c2", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001810" }, { "name": "ThreadHandle", "value": "0x00001874" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --skip-read-main-dll --metrics-shmem-handle=5928,i,5358152234413628994,12107027077339134663,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5944 /prefetch:8" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "9228" } ], "repeated": 0, "id": 156 }, { "timestamp": "2026-05-28 23:34:29,453", "thread_id": "8360", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\wpnapps" }, { "name": "DllBase", "value": "0x7ffbb08e0000" } ], "repeated": 0, "id": 157 }, { "timestamp": "2026-05-28 23:34:29,453", "thread_id": "8232", "caller": "0x7ff66c4a7d66", "parentcaller": "0x7ff66c4a81c2", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000183c" }, { "name": "ThreadHandle", "value": "0x00001834" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1780011216982031 --launch-time-ticks=52463920 --skip-read-main-dll --metrics-shmem-handle=5996,i,12708371531593665223,15506833222681786947,2097152 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=6000 /prefetch:1" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "9260" } ], "repeated": 0, "id": 158 }, { "timestamp": "2026-05-28 23:34:29,453", "thread_id": "8224", "caller": "0x7ff66c4a7d66", "parentcaller": "0x7ff66c4a81c2", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --skip-read-main-dll --metrics-shmem-handle=5928,i,5358152234413628994,12107027077339134663,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5944 /prefetch:8" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "9228" }, { "name": "ThreadId", "value": "9232" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001810" }, { "name": "ThreadHandle", "value": "0x00001874" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 159 }, { "timestamp": "2026-05-28 23:34:29,453", "thread_id": "8232", "caller": "0x7ff66c4a7d66", "parentcaller": "0x7ff66c4a81c2", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1780011216982031 --launch-time-ticks=52463920 --skip-read-main-dll --metrics-shmem-handle=5996,i,12708371531593665223,15506833222681786947,2097152 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=6000 /prefetch:1" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "9260" }, { "name": "ThreadId", "value": "9264" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x0000183c" }, { "name": "ThreadHandle", "value": "0x00001834" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 160 }, { "timestamp": "2026-05-28 23:34:29,484", "thread_id": "8796", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WindowsCodecs" }, { "name": "DllBase", "value": "0x7ffbbfeb0000" } ], "repeated": 0, "id": 161 }, { "timestamp": "2026-05-28 23:34:29,484", "thread_id": "8796", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\thumbcache" }, { "name": "DllBase", "value": "0x7ffbb0100000" } ], "repeated": 0, "id": 162 }, { "timestamp": "2026-05-28 23:34:29,500", "thread_id": "8796", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7ffbc42c0000" } ], "repeated": 0, "id": 163 }, { "timestamp": "2026-05-28 23:34:29,500", "thread_id": "8796", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7ffbbf330000" } ], "repeated": 0, "id": 164 }, { "timestamp": "2026-05-28 23:34:29,953", "thread_id": "6212", "caller": "0x7ffbc547c5f2", "parentcaller": "0x7ffbc5479666", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\capauthz" }, { "name": "DllBase", "value": "0x7ffbbcf40000" } ], "repeated": 0, "id": 165 }, { "timestamp": "2026-05-28 23:34:29,953", "thread_id": "6212", "caller": "0x7ffbc547c5f2", "parentcaller": "0x7ffbc5479666", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\windows.staterepositorycore" }, { "name": "DllBase", "value": "0x7ffbbba60000" } ], "repeated": 0, "id": 166 }, { "timestamp": "2026-05-28 23:34:29,953", "thread_id": "6212", "caller": "0x7ffbc547c5f2", "parentcaller": "0x7ffbc5479666", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000191c" }, { "name": "ThreadHandle", "value": "0x0000170c" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5816,i,7984218614831481947,5522388298470254199,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5860 /prefetch:8" }, { "name": "DllPath", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application;" }, { "name": "ProcessId", "value": "9452" } ], "repeated": 0, "id": 167 }, { "timestamp": "2026-05-28 23:34:29,984", "thread_id": "8228", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\wlanapi" }, { "name": "DllBase", "value": "0x7ffbbd0c0000" } ], "repeated": 0, "id": 168 }, { "timestamp": "2026-05-28 23:34:29,984", "thread_id": "8228", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\wlanapi" }, { "name": "DllBase", "value": "0x7ffbbd0c0000" } ], "repeated": 0, "id": 169 }, { "timestamp": "2026-05-28 23:34:29,984", "thread_id": "8228", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.ApplicationModel" }, { "name": "DllBase", "value": "0x7ffbb3900000" } ], "repeated": 0, "id": 170 }, { "timestamp": "2026-05-28 23:34:29,984", "thread_id": "8228", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\AppXDeploymentClient" }, { "name": "DllBase", "value": "0x7ffbbe410000" } ], "repeated": 0, "id": 171 }, { "timestamp": "2026-05-28 23:34:30,015", "thread_id": "8228", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ncrypt" }, { "name": "DllBase", "value": "0x7ffbc4c60000" } ], "repeated": 0, "id": 172 }, { "timestamp": "2026-05-28 23:34:30,015", "thread_id": "8228", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\NTASN1" }, { "name": "DllBase", "value": "0x7ffbc4c20000" } ], "repeated": 0, "id": 173 }, { "timestamp": "2026-05-28 23:34:30,015", "thread_id": "8236", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\NETAPI32" }, { "name": "DllBase", "value": "0x7ffbb3170000" } ], "repeated": 0, "id": 174 }, { "timestamp": "2026-05-28 23:34:30,015", "thread_id": "8228", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\PCPKsp" }, { "name": "DllBase", "value": "0x7ffbbcfa0000" } ], "repeated": 0, "id": 175 }, { "timestamp": "2026-05-28 23:34:30,015", "thread_id": "8228", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x7ffbc6800000" } ], "repeated": 0, "id": 176 }, { "timestamp": "2026-05-28 23:34:30,015", "thread_id": "8228", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\tbs" }, { "name": "DllBase", "value": "0x7ffbbce20000" } ], "repeated": 0, "id": 177 }, { "timestamp": "2026-05-28 23:34:30,015", "thread_id": "8228", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\ncryptprov" }, { "name": "DllBase", "value": "0x7ffbb23c0000" } ], "repeated": 0, "id": 178 }, { "timestamp": "2026-05-28 23:34:30,015", "thread_id": "8272", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\mswsock" }, { "name": "DllBase", "value": "0x7ffbc4900000" } ], "repeated": 0, "id": 179 }, { "timestamp": "2026-05-28 23:34:30,125", "thread_id": "6212", "caller": "0x7ffbc5479666", "parentcaller": "0x7ffbc649cec4", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5816,i,7984218614831481947,5522388298470254199,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5860 /prefetch:8" }, { "name": "CreationFlags", "value": "0x00080400", "pretty_value": "CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "9452" }, { "name": "ThreadId", "value": "9456" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x0000191c" }, { "name": "ThreadHandle", "value": "0x0000170c" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 180 }, { "timestamp": "2026-05-28 23:34:50,750", "thread_id": "8952", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.Security.Authentication.OnlineId" }, { "name": "DllBase", "value": "0x7ffbac470000" } ], "repeated": 0, "id": 181 }, { "timestamp": "2026-05-28 23:34:50,937", "thread_id": "8464", "caller": "0x7ffbc547c5f2", "parentcaller": "0x7ffbc5479666", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001b90" }, { "name": "ThreadHandle", "value": "0x00001b6c" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=6996,i,10244934382733242657,13532683168228175185,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=7000 /prefetch:8" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "9560" } ], "repeated": 0, "id": 182 }, { "timestamp": "2026-05-28 23:34:50,937", "thread_id": "8464", "caller": "0x7ffbc5479666", "parentcaller": "0x7ffbc649cec4", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=6996,i,10244934382733242657,13532683168228175185,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=7000 /prefetch:8" }, { "name": "CreationFlags", "value": "0x00080000", "pretty_value": "EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "9560" }, { "name": "ThreadId", "value": "9556" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001b90" }, { "name": "ThreadHandle", "value": "0x00001b6c" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 183 }, { "timestamp": "2026-05-28 23:34:56,640", "thread_id": "8464", "caller": "0x7ffbc547c5f2", "parentcaller": "0x7ffbc5479666", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001b74" }, { "name": "ThreadHandle", "value": "0x00001b24" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=7088,i,8913639506253746188,10001621401996875507,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=6996 /prefetch:8" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "7760" } ], "repeated": 0, "id": 184 }, { "timestamp": "2026-05-28 23:34:56,656", "thread_id": "8464", "caller": "0x7ffbc5479666", "parentcaller": "0x7ffbc649cec4", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=7088,i,8913639506253746188,10001621401996875507,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=6996 /prefetch:8" }, { "name": "CreationFlags", "value": "0x00080000", "pretty_value": "EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "7760" }, { "name": "ThreadId", "value": "7752" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001b74" }, { "name": "ThreadHandle", "value": "0x00001b24" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 185 }, { "timestamp": "2026-05-28 23:34:57,312", "thread_id": "8212", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.System.UserProfile.DiagnosticsSettings" }, { "name": "DllBase", "value": "0x7ffbc0960000" } ], "repeated": 0, "id": 186 }, { "timestamp": "2026-05-28 23:34:57,406", "thread_id": "8464", "caller": "0x7ffbc547c5f2", "parentcaller": "0x7ffbc5479666", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001bc8" }, { "name": "ThreadHandle", "value": "0x000018c0" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=6972,i,6352578797868847121,17012287025672144076,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=6948 /prefetch:8" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "2224" } ], "repeated": 0, "id": 187 }, { "timestamp": "2026-05-28 23:34:57,406", "thread_id": "8464", "caller": "0x7ffbc5479666", "parentcaller": "0x7ffbc649cec4", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=6972,i,6352578797868847121,17012287025672144076,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=6948 /prefetch:8" }, { "name": "CreationFlags", "value": "0x00080000", "pretty_value": "EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "2224" }, { "name": "ThreadId", "value": "2240" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001bc8" }, { "name": "ThreadHandle", "value": "0x000018c0" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 188 }, { "timestamp": "2026-05-28 23:34:58,406", "thread_id": "9016", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\srvcli" }, { "name": "DllBase", "value": "0x7ffbba6c0000" } ], "repeated": 0, "id": 189 }, { "timestamp": "2026-05-28 23:34:58,406", "thread_id": "9016", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\urlmon" }, { "name": "DllBase", "value": "0x7ffbba360000" } ], "repeated": 0, "id": 190 }, { "timestamp": "2026-05-28 23:34:58,406", "thread_id": "9016", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\FLTLIB" }, { "name": "DllBase", "value": "0x7ffbb3880000" } ], "repeated": 0, "id": 191 }, { "timestamp": "2026-05-28 23:34:58,406", "thread_id": "9016", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\virtdisk" }, { "name": "DllBase", "value": "0x7ffbb6ed0000" } ], "repeated": 0, "id": 192 }, { "timestamp": "2026-05-28 23:34:58,406", "thread_id": "9016", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\smartscreenps" }, { "name": "DllBase", "value": "0x7ffbb6cf0000" } ], "repeated": 0, "id": 193 }, { "timestamp": "2026-05-28 23:34:58,406", "thread_id": "9016", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\shdocvw" }, { "name": "DllBase", "value": "0x7ffbaa3e0000" } ], "repeated": 0, "id": 194 }, { "timestamp": "2026-05-28 23:35:00,453", "thread_id": "3916", "caller": "0x7ff66c450661", "parentcaller": "0x7ff66c44f1a0", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000008b8" }, { "name": "ThreadHandle", "value": "0x000008b0" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "9420" } ], "repeated": 0, "id": 195 } ], "threads": [ "3916", "3080", "8224", "8280", "8264", "8304", "8348", "8364", "8232", "8464", "8216", "8432", "8428", "8268", "9080", "8324", "9156", "8236", "8436", "8360", "8852", "8228", "6212", "8796", "8272", "8952", "8212", "9016" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" \"https://badoomovies.com/download/BadooMovies.exe\"", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff66c3b0000", "MainExeSize": "0x00505000", "Bitness": "64-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } }, { "process_id": 9452, "process_name": "identity_helper.exe", "parent_id": 5704, "module_path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe", "first_seen": "2026-05-28 23:34:30,139", "calls": [ { "timestamp": "2026-05-28 23:34:30,280", "thread_id": "9456", "caller": "0x7ffbc7b69aff", "parentcaller": "0x7ffbc7bbc295", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000060", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf" }, { "name": "BaseAddress", "value": "0x7ffb84e10000" }, { "name": "InitRoutine", "value": "0x7ffb84f92a60" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 0 }, { "timestamp": "2026-05-28 23:34:30,295", "thread_id": "9456", "caller": "0x7ffbc7b69aff", "parentcaller": "0x7ffbc7bbc295", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000010", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf" }, { "name": "BaseAddress", "value": "0x7ffb84e10000" }, { "name": "InitRoutine", "value": "0x7ffb84fec510" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-05-28 23:34:30,327", "thread_id": "9456", "caller": "0x7ffbc7b69aff", "parentcaller": "0x7ffbc7bbc295", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000041", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf" }, { "name": "BaseAddress", "value": "0x7ffb84e10000" }, { "name": "InitRoutine", "value": "0x7ffb84fc5c30" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-05-28 23:34:30,342", "thread_id": "9456", "caller": "0x7ffbc7b69aff", "parentcaller": "0x7ffbc7bbc295", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000090", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf" }, { "name": "BaseAddress", "value": "0x7ffb84e10000" }, { "name": "InitRoutine", "value": "0x7ffb84fec590" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-05-28 23:34:30,374", "thread_id": "9456", "caller": "0x7ffbc7b69aff", "parentcaller": "0x7ffbc7bbc295", "category": "system", "api": "LdrpCallInitRoutine", "status": false, "return": "0x00000000", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf" }, { "name": "BaseAddress", "value": "0x7ffb84e10000" }, { "name": "InitRoutine", "value": "0x7ffb84f5efd0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 4 }, { "timestamp": "2026-05-28 23:34:30,405", "thread_id": "9456", "caller": "0x7ffbc7b69aff", "parentcaller": "0x7ffbc7bbc295", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000050", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf" }, { "name": "BaseAddress", "value": "0x7ffb84e10000" }, { "name": "InitRoutine", "value": "0x7ffb84fc1950" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500f156", "parentcaller": "0x7ffb85010c0a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffb852bf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000008", "pretty_value": "PAGE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fb27", "parentcaller": "0x7ffb8500faa7", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-fibers-l1-1-2" }, { "name": "BaseAddress", "value": "0x7ffbc5420000" } ], "repeated": 0, "id": 7 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fb27", "parentcaller": "0x7ffb8500faa7", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc5420000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-fibers-l1-1-2" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fc58", "parentcaller": "0x7ffb8500faa7", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5420000" }, { "name": "FunctionName", "value": "FlsGetValue2" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fbd7", "parentcaller": "0x7ffb8500faa7", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffb852bf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 10 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fc08", "parentcaller": "0x7ffb8500faa7", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffb852bf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f39070", "parentcaller": "0x7ffb84fc2c96", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\bcryptprimitives" }, { "name": "DllBase", "value": "0x7ffbc5750000" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f39070", "parentcaller": "0x7ffb84fc2c96", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "bcryptprimitives.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5750000" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f39070", "parentcaller": "0x7ffb84fc2c96", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc5750000", "arguments": [ { "name": "lpLibFileName", "value": "bcryptprimitives.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f39089", "parentcaller": "0x7ffb84fc2c96", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "bcryptprimitives.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5750000" }, { "name": "FunctionName", "value": "ProcessPrng" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc5765010" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84fc3b9c", "parentcaller": "0x7ffb84fc3d77", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x242000000000" }, { "name": "RegionSize", "value": "0x800000000" }, { "name": "Protection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84fc3b9c", "parentcaller": "0x7ffb84fc3d77", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43da61bd0000" }, { "name": "RegionSize", "value": "0x400000000" }, { "name": "Protection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84fc3c18", "parentcaller": "0x7ffb84f3b8df", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43da61bd1000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x242000004000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x242000008000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8501006a", "parentcaller": "0x7ffb85010c0a", "category": "misc", "api": "GetCommandLineA", "status": true, "return": "0x1bce4c05890", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5816,i,7984218614831481947,5522388298470254199,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5860 /prefetch:8" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb85010077", "parentcaller": "0x7ffb85010c0a", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x1bce4c03ed6", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5816,i,7984218614831481947,5522388298470254199,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5860 /prefetch:8" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x242000018000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fb27", "parentcaller": "0x7ffb8500f6c7", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-localization-l1-2-1" }, { "name": "BaseAddress", "value": "0x7ffbc5420000" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fb27", "parentcaller": "0x7ffb8500f6c7", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc5420000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-localization-l1-2-1" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 25 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fc58", "parentcaller": "0x7ffb8500f6c7", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5420000" }, { "name": "FunctionName", "value": "LCMapStringEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc543d3c0" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fbd7", "parentcaller": "0x7ffb8500f6c7", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffb852bf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fc08", "parentcaller": "0x7ffb8500f6c7", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffb852bf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x242000028000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fb27", "parentcaller": "0x7ffb8500f1d6", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32" }, { "name": "BaseAddress", "value": "0x7ffbc6480000" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fb27", "parentcaller": "0x7ffb8500f1d6", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc6480000", "arguments": [ { "name": "lpLibFileName", "value": "kernel32" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fc58", "parentcaller": "0x7ffb8500f1d6", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7ffbc6480000" }, { "name": "FunctionName", "value": "AreFileApisANSI" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc64a0f00" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fbd7", "parentcaller": "0x7ffb8500f1d6", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffb852bf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fc08", "parentcaller": "0x7ffb8500f1d6", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffb852bf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24200002c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x242000038000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24200003c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x242000048000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24200004c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x242000058000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24200005c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24200006c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x242000070000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x242000080000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f7c301", "parentcaller": "0x7ffb84fffa72", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc6480000" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f7c311", "parentcaller": "0x7ffb84fffa72", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7ffbc6480000" }, { "name": "FunctionName", "value": "GetSystemTimePreciseAsFileTime" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc64a5350" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x242000090000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fb27", "parentcaller": "0x7ffb8500f8f9", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-string-l1-1-0" }, { "name": "BaseAddress", "value": "0x7ffbc5420000" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fb27", "parentcaller": "0x7ffb8500f8f9", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc5420000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-string-l1-1-0" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fc58", "parentcaller": "0x7ffb8500f8f9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5420000" }, { "name": "FunctionName", "value": "CompareStringEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc5447130" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fbd7", "parentcaller": "0x7ffb8500f8f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffb852bf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fc08", "parentcaller": "0x7ffb8500f8f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffb852bf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fc58", "parentcaller": "0x7ffb8500f922", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5420000" }, { "name": "FunctionName", "value": "EnumSystemLocalesEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc54a7f40" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fbd7", "parentcaller": "0x7ffb8500f922", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffb852bf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fc08", "parentcaller": "0x7ffb8500f922", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffb852bf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fb27", "parentcaller": "0x7ffb8500f94b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-datetime-l1-1-1" }, { "name": "BaseAddress", "value": "0x7ffbc5420000" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fb27", "parentcaller": "0x7ffb8500f94b", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc5420000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-datetime-l1-1-1" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fc58", "parentcaller": "0x7ffb8500f94b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5420000" }, { "name": "FunctionName", "value": "GetDateFormatEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc54955b0" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fbd7", "parentcaller": "0x7ffb8500f94b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffb852bf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fc08", "parentcaller": "0x7ffb8500f94b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffb852bf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fc58", "parentcaller": "0x7ffb8500f974", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5420000" }, { "name": "FunctionName", "value": "GetLocaleInfoEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc5440210" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fbd7", "parentcaller": "0x7ffb8500f974", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffb852bf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fc08", "parentcaller": "0x7ffb8500f974", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffb852bf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fc58", "parentcaller": "0x7ffb8500f99d", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5420000" }, { "name": "FunctionName", "value": "GetTimeFormatEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc549d1a0" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fbd7", "parentcaller": "0x7ffb8500f99d", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffb852bf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fc08", "parentcaller": "0x7ffb8500f99d", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffb852bf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fc58", "parentcaller": "0x7ffb8500f9c6", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5420000" }, { "name": "FunctionName", "value": "GetUserDefaultLocaleName" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc545ae80" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fbd7", "parentcaller": "0x7ffb8500f9c6", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffb852bf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fc08", "parentcaller": "0x7ffb8500f9c6", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffb852bf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fc58", "parentcaller": "0x7ffb8500f9ef", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5420000" }, { "name": "FunctionName", "value": "IsValidLocaleName" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc543ad90" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fbd7", "parentcaller": "0x7ffb8500f9ef", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffb852bf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fc08", "parentcaller": "0x7ffb8500f9ef", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffb852bf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fb27", "parentcaller": "0x7ffb8500fa41", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-localization-obsolete-l1-2-0" }, { "name": "BaseAddress", "value": "0x7ffbc5420000" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fb27", "parentcaller": "0x7ffb8500fa41", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc5420000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-localization-obsolete-l1-2-0" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fc58", "parentcaller": "0x7ffb8500fa41", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5420000" }, { "name": "FunctionName", "value": "LCIDToLocaleName" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc543ae60" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fbd7", "parentcaller": "0x7ffb8500fa41", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffb852bf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fc08", "parentcaller": "0x7ffb8500fa41", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffb852bf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fc58", "parentcaller": "0x7ffb8500fa6a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5420000" }, { "name": "FunctionName", "value": "LocaleNameToLCID" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc5490070" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fbd7", "parentcaller": "0x7ffb8500fa6a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffb852bf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb8500fc08", "parentcaller": "0x7ffb8500fa6a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffb852bf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x242000098000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f87e31", "parentcaller": "0x7ffb84f0b049", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "bcryptprimitives.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5750000" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f87e31", "parentcaller": "0x7ffb84f0b049", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc5750000", "arguments": [ { "name": "lpLibFileName", "value": "bcryptprimitives.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f87e4a", "parentcaller": "0x7ffb84f0b049", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "bcryptprimitives.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5750000" }, { "name": "FunctionName", "value": "ProcessPrng" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc5765010" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f80e68", "parentcaller": "0x7ffb84f80dc8", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\usp10.dll" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24200009c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2420000ac000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f7fbd4", "parentcaller": "0x7ffb84f80076", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xe4r]D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f7fc42", "parentcaller": "0x7ffb84f80076", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x1bce4c03ed6", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5816,i,7984218614831481947,5522388298470254199,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5860 /prefetch:8" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f7fcd6", "parentcaller": "0x7ffb84f80076", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc6480000" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f7fce6", "parentcaller": "0x7ffb84f80076", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7ffbc6480000" }, { "name": "FunctionName", "value": "IsWow64Process" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc649f980" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f7feef", "parentcaller": "0x7ffb84f800f0", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f7feef", "parentcaller": "0x7ffb84f800f0", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "1", "pretty_value": "FILE_OPEN" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f8019b", "parentcaller": "0x7ffb84f803bc", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000210" }, { "name": "DesiredAccess", "value": "0x00000201", "pretty_value": "KEY_QUERY_VALUE|0x00000200" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f802c2", "parentcaller": "0x7ffb84f80346", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000210" }, { "name": "ValueName", "value": "channel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\channel" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f802c2", "parentcaller": "0x7ffb84f80346", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000210" }, { "name": "ValueName", "value": "channel" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "stable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\channel" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f803ea", "parentcaller": "0x7ffb84f808ef", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2420000bc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2420000c8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f3ba80", "parentcaller": "0x7ffb84f3ab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x242000038000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f3ba80", "parentcaller": "0x7ffb84f3ab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x242000090000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f7feef", "parentcaller": "0x7ffb84f800f0", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f7feef", "parentcaller": "0x7ffb84f800f0", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "1", "pretty_value": "FILE_OPEN" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-05-28 23:34:30,436", "thread_id": "9456", "caller": "0x7ffb84f8019b", "parentcaller": "0x7ffb84f803bc", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000210" }, { "name": "DesiredAccess", "value": "0x00000201", "pretty_value": "KEY_QUERY_VALUE|0x00000200" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f802c2", "parentcaller": "0x7ffb84f80346", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000210" }, { "name": "ValueName", "value": "ap" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ap" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f803ea", "parentcaller": "0x7ffb84f8195d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f7feef", "parentcaller": "0x7ffb84f800f0", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f7feef", "parentcaller": "0x7ffb84f800f0", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "1", "pretty_value": "FILE_OPEN" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f8019b", "parentcaller": "0x7ffb84f803bc", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000210" }, { "name": "DesiredAccess", "value": "0x00000201", "pretty_value": "KEY_QUERY_VALUE|0x00000200" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f802c2", "parentcaller": "0x7ffb84f80346", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000210" }, { "name": "ValueName", "value": "name" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\name" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f802c2", "parentcaller": "0x7ffb84f80346", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000210" }, { "name": "ValueName", "value": "name" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\name" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f803ea", "parentcaller": "0x7ffb84f819ed", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb850432c9", "parentcaller": "0x7ffb84f8094e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xaby\t\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00jy\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb850432c9", "parentcaller": "0x7ffb84f8094e", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000210" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb850432c9", "parentcaller": "0x7ffb84f8094e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000210" }, { "name": "ValueName", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-AU" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb850432c9", "parentcaller": "0x7ffb84f8094e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb850432c9", "parentcaller": "0x7ffb84f8094e", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000210" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb850432c9", "parentcaller": "0x7ffb84f8094e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000210" }, { "name": "ValueName", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-AU" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb850432c9", "parentcaller": "0x7ffb84f8094e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" } ], "repeated": 0, "id": 119 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb850432c9", "parentcaller": "0x7ffb84f8094e", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000084" }, { "name": "ValueName", "value": "000603xx" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "kernel32.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb850432c9", "parentcaller": "0x7ffb84f8094e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc6480000" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb850432c9", "parentcaller": "0x7ffb84f8094e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc6480000", "arguments": [ { "name": "lpLibFileName", "value": "kernel32.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 122 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb850432c9", "parentcaller": "0x7ffb84f8094e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7ffbc6480000" }, { "name": "FunctionName", "value": "SortGetHandle" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc648a190" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb850432c9", "parentcaller": "0x7ffb84f8094e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7ffbc6480000" }, { "name": "FunctionName", "value": "SortCloseHandle" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc64a0170" } ], "repeated": 0, "id": 124 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb850432c9", "parentcaller": "0x7ffb84f8094e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000210" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb850432c9", "parentcaller": "0x7ffb84f8094e", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000218" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000210" }, { "name": "FileName", "value": "C:\\Windows\\Globalization\\Sorting\\SortDefault.nls" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb850432c9", "parentcaller": "0x7ffb84f8094e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000218" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce9100000" }, { "name": "SectionOffset", "value": "0x445d72e360" }, { "name": "ViewSize", "value": "0x00338000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb850432c9", "parentcaller": "0x7ffb84f8094e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000218" } ], "repeated": 0, "id": 128 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb850432c9", "parentcaller": "0x7ffb84f8094e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" } ], "repeated": 0, "id": 129 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb850432c9", "parentcaller": "0x7ffb84f8094e", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000210" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids" } ], "repeated": 0, "id": 130 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb850432c9", "parentcaller": "0x7ffb84f8094e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000210" }, { "name": "ValueName", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-AU" } ], "repeated": 0, "id": 131 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb850432c9", "parentcaller": "0x7ffb84f8094e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000210" }, { "name": "ValueName", "value": "en" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en" } ], "repeated": 0, "id": 132 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f3ba80", "parentcaller": "0x7ffb84f3ab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2420000bc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 133 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f3ba80", "parentcaller": "0x7ffb84f3ab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2420000c8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 134 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f80fba", "parentcaller": "0x7ffb84f55699", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x1bce4c03ed6", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5816,i,7984218614831481947,5522388298470254199,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5860 /prefetch:8" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2420000d4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2420000c8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 137 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2420000bc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2420000e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 139 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f3ba80", "parentcaller": "0x7ffb84f3ab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2420000ac000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 140 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f3ba80", "parentcaller": "0x7ffb84f3ab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2420000bc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 141 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f3ba80", "parentcaller": "0x7ffb84f3ab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2420000e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 142 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f3ba80", "parentcaller": "0x7ffb84f3ab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2420000c8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 143 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f555e1", "parentcaller": "0x7ffb84f556aa", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x1bce4c03ed6", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5816,i,7984218614831481947,5522388298470254199,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5860 /prefetch:8" } ], "repeated": 1, "id": 144 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2420000c8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 145 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2420000bc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 146 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2420000e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 147 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2420000ac000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 148 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f3ba80", "parentcaller": "0x7ffb84f3ab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2420000bc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 149 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f3ba80", "parentcaller": "0x7ffb84f3ab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2420000e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 150 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2420000bc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 151 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2420000e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 152 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2420000f0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 153 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f3ba80", "parentcaller": "0x7ffb84f3ab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2420000ac000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 154 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f3ba80", "parentcaller": "0x7ffb84f3ab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2420000c8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 155 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f3ba80", "parentcaller": "0x7ffb84f3ab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2420000bc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 156 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f3ba80", "parentcaller": "0x7ffb84f3ab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2420000e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 157 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f3ba80", "parentcaller": "0x7ffb84f3ab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2420000f0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 158 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84fcf562", "parentcaller": "0x7ffb851875e5", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc6480000" } ], "repeated": 0, "id": 159 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84fcf562", "parentcaller": "0x7ffb851875e5", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc6480000", "arguments": [ { "name": "lpLibFileName", "value": "kernel32.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 160 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb851875e5", "parentcaller": "0x7ffb851820c4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7ffbc6480000" }, { "name": "FunctionName", "value": "InitializeCriticalSectionEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc64a4d00" } ], "repeated": 0, "id": 161 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84fcf3fe", "parentcaller": "0x7ffb85182105", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000218" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\pipe\\crashpad_5704_NNHQBWYIOOVGEUEH" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "0" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 162 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84fcf425", "parentcaller": "0x7ffb85182105", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000218" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\crashpad_5704_NNHQBWYIOOVGEUEH" }, { "name": "FileInformationClass", "value": "23", "pretty_value": "FilePipeInformation" }, { "name": "FileInformation", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 163 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84fcf9bb", "parentcaller": "0x7ffb84fcff6d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000218" } ], "repeated": 0, "id": 164 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb85180ad2", "parentcaller": "0x7ffb8518213f", "category": "hooking", "api": "SetUnhandledExceptionFilter", "status": true, "return": "0x00000001", "arguments": [ { "name": "ExceptionFilter", "value": "0x7ffb85181e30" } ], "repeated": 0, "id": 165 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb85180ae4", "parentcaller": "0x7ffb8518213f", "category": "hooking", "api": "RtlAddVectoredExceptionHandler", "status": true, "return": "0x1bce4bf07e0", "arguments": [ { "name": "First", "value": "1" }, { "name": "Handler", "value": "0x7ffb85181f50" } ], "repeated": 0, "id": 166 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f82947", "parentcaller": "0x7ffb84f828b9", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 167 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb84f82947", "parentcaller": "0x7ffb84f828b9", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "1", "pretty_value": "FILE_OPEN" } ], "repeated": 0, "id": 168 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb85082986", "parentcaller": "0x7ffb850828f3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff64b762000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 169 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb850829aa", "parentcaller": "0x7ffb850828f3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff64b762000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 170 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffb850829aa", "parentcaller": "0x7ffb850828f3", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf" }, { "name": "BaseAddress", "value": "0x7ffb84e10000" }, { "name": "InitRoutine", "value": "0x7ffb84fed2f0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 171 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffbb4d3125f", "parentcaller": "0x7ffbc57fe473", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 172 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c35000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 173 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffbc548c976", "parentcaller": "0x7ffbb4d481dc", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbb4f0b000" }, { "name": "ModuleName", "value": "dbghelp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 174 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc544e6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-file-l1-2-1.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5420000" } ], "repeated": 0, "id": 175 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc544e6a1", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc5420000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-file-l1-2-1.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 176 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbb4d48089", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5420000" }, { "name": "FunctionName", "value": "GetTempPathW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc5494af0" } ], "repeated": 0, "id": 177 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffbc548c976", "parentcaller": "0x7ffbb4d4826c", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbb4f0b000" }, { "name": "ModuleName", "value": "dbghelp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 178 }, { "timestamp": "2026-05-28 23:34:30,452", "thread_id": "9456", "caller": "0x7ffbc548c976", "parentcaller": "0x7ffbb4d4826c", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\dbghelp" }, { "name": "BaseAddress", "value": "0x7ffbb4d30000" }, { "name": "InitRoutine", "value": "0x7ffbb4d4b1a0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 179 }, { "timestamp": "2026-05-28 23:34:30,467", "thread_id": "9456", "caller": "0x7ffbc7b69aff", "parentcaller": "0x7ffbc7c23d4d", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x000000a0", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" }, { "name": "BaseAddress", "value": "0x7ff64b540000" }, { "name": "InitRoutine", "value": "0x7ff64b5cfba0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 180 }, { "timestamp": "2026-05-28 23:34:30,483", "thread_id": "9456", "caller": "0x7ffbc7b69aff", "parentcaller": "0x7ffbc7c23d4d", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000080", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" }, { "name": "BaseAddress", "value": "0x7ff64b540000" }, { "name": "InitRoutine", "value": "0x7ff64b614280" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 181 }, { "timestamp": "2026-05-28 23:34:30,499", "thread_id": "9456", "caller": "0x7ffbc7b69aff", "parentcaller": "0x7ffbc7c23d4d", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000015", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" }, { "name": "BaseAddress", "value": "0x7ff64b540000" }, { "name": "InitRoutine", "value": "0x7ff64b5fa0e0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 182 }, { "timestamp": "2026-05-28 23:34:30,514", "thread_id": "9456", "caller": "0x7ffbc7b69aff", "parentcaller": "0x7ffbc7c23d4d", "category": "system", "api": "LdrpCallInitRoutine", "status": false, "return": "0x00000000", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" }, { "name": "BaseAddress", "value": "0x7ff64b540000" }, { "name": "InitRoutine", "value": "0x7ff64b614300" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 183 }, { "timestamp": "2026-05-28 23:34:30,530", "thread_id": "9456", "caller": "0x7ffbc7b69aff", "parentcaller": "0x7ffbc7c23d4d", "category": "system", "api": "LdrpCallInitRoutine", "status": false, "return": "0x00000000", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" }, { "name": "BaseAddress", "value": "0x7ff64b540000" }, { "name": "InitRoutine", "value": "0x7ff64b5b5840" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 184 }, { "timestamp": "2026-05-28 23:34:30,545", "thread_id": "9456", "caller": "0x7ffbc7b69aff", "parentcaller": "0x7ffbc7c23d4d", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000080", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" }, { "name": "BaseAddress", "value": "0x7ff64b540000" }, { "name": "InitRoutine", "value": "0x7ff64b5f5f80" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 185 }, { "timestamp": "2026-05-28 23:34:30,545", "thread_id": "9456", "caller": "0x7ffbc7bc507d", "parentcaller": "0x7ffbc7bc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 186 }, { "timestamp": "2026-05-28 23:34:30,545", "thread_id": "9456", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ff64b614f90" }, { "name": "Parameter", "value": "0x445d8cf000" } ], "repeated": 0, "id": 187 }, { "timestamp": "2026-05-28 23:34:30,545", "thread_id": "9624", "caller": "0x7ffbc7baeb32", "parentcaller": "0x7ffbc7b677c3", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000003c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 188 }, { "timestamp": "2026-05-28 23:34:30,545", "thread_id": "9628", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x242000100000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 189 }, { "timestamp": "2026-05-28 23:34:30,545", "thread_id": "9628", "caller": "0x7ffbc7bc507d", "parentcaller": "0x7ffbc7bc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 190 }, { "timestamp": "2026-05-28 23:34:30,545", "thread_id": "9628", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ffb864a1ed0" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 191 }, { "timestamp": "2026-05-28 23:34:30,545", "thread_id": "9616", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c24000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 192 }, { "timestamp": "2026-05-28 23:34:30,545", "thread_id": "9616", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4d05000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 193 }, { "timestamp": "2026-05-28 23:34:30,545", "thread_id": "9616", "caller": "0x7ffbc7bc507d", "parentcaller": "0x7ffbc7bc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 194 }, { "timestamp": "2026-05-28 23:34:30,545", "thread_id": "9616", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ffb864a1a00" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 195 }, { "timestamp": "2026-05-28 23:34:30,545", "thread_id": "9620", "caller": "0x7ffbc7bc507d", "parentcaller": "0x7ffbc7bc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 196 }, { "timestamp": "2026-05-28 23:34:30,545", "thread_id": "9620", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ffb864a1e10" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 197 }, { "timestamp": "2026-05-28 23:34:30,545", "thread_id": "9624", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c25000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 198 }, { "timestamp": "2026-05-28 23:34:30,545", "thread_id": "9624", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x242000005000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 199 }, { "timestamp": "2026-05-28 23:34:30,545", "thread_id": "9624", "caller": "0x7ffbc7bc507d", "parentcaller": "0x7ffbc7bc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 200 }, { "timestamp": "2026-05-28 23:34:30,545", "thread_id": "9624", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ffb864a2030" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 201 }, { "timestamp": "2026-05-28 23:34:30,561", "thread_id": "9456", "caller": "0x7ff64b634096", "parentcaller": "0x7ff64b635b4a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff64b7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000008", "pretty_value": "PAGE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 202 }, { "timestamp": "2026-05-28 23:34:30,561", "thread_id": "9456", "caller": "0x7ff64b634a67", "parentcaller": "0x7ff64b6349e7", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-fibers-l1-1-2" }, { "name": "BaseAddress", "value": "0x7ffbc5420000" } ], "repeated": 0, "id": 203 }, { "timestamp": "2026-05-28 23:34:30,561", "thread_id": "9456", "caller": "0x7ff64b634a67", "parentcaller": "0x7ff64b6349e7", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc5420000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-fibers-l1-1-2" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 204 }, { "timestamp": "2026-05-28 23:34:30,561", "thread_id": "9456", "caller": "0x7ff64b634b98", "parentcaller": "0x7ff64b6349e7", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5420000" }, { "name": "FunctionName", "value": "FlsGetValue2" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 205 }, { "timestamp": "2026-05-28 23:34:30,561", "thread_id": "9456", "caller": "0x7ff64b634b17", "parentcaller": "0x7ff64b6349e7", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff64b7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 206 }, { "timestamp": "2026-05-28 23:34:30,561", "thread_id": "9456", "caller": "0x7ff64b634b48", "parentcaller": "0x7ff64b6349e7", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff64b7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 207 }, { "timestamp": "2026-05-28 23:34:30,561", "thread_id": "9456", "caller": "0x7ff64b5a1500", "parentcaller": "0x7ff64b5f7156", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "bcryptprimitives.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5750000" } ], "repeated": 0, "id": 208 }, { "timestamp": "2026-05-28 23:34:30,561", "thread_id": "9456", "caller": "0x7ff64b5a1500", "parentcaller": "0x7ff64b5f7156", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc5750000", "arguments": [ { "name": "lpLibFileName", "value": "bcryptprimitives.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 209 }, { "timestamp": "2026-05-28 23:34:30,561", "thread_id": "9456", "caller": "0x7ff64b5a1519", "parentcaller": "0x7ff64b5f7156", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "bcryptprimitives.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5750000" }, { "name": "FunctionName", "value": "ProcessPrng" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc5765010" } ], "repeated": 0, "id": 210 }, { "timestamp": "2026-05-28 23:34:30,561", "thread_id": "9456", "caller": "0x7ff64b5f805c", "parentcaller": "0x7ff64b5f8237", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x260800000000" }, { "name": "RegionSize", "value": "0x800000000" }, { "name": "Protection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 211 }, { "timestamp": "2026-05-28 23:34:30,561", "thread_id": "9456", "caller": "0x7ff64b5f805c", "parentcaller": "0x7ff64b5f8237", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x79aaf3820000" }, { "name": "RegionSize", "value": "0x400000000" }, { "name": "Protection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 212 }, { "timestamp": "2026-05-28 23:34:30,561", "thread_id": "9456", "caller": "0x7ff64b5f80d8", "parentcaller": "0x7ff64b5a297f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x79aaf3821000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 213 }, { "timestamp": "2026-05-28 23:34:30,561", "thread_id": "9456", "caller": "0x7ff64b5a2b9b", "parentcaller": "0x7ff64b5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x260800004000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 214 }, { "timestamp": "2026-05-28 23:34:30,561", "thread_id": "9456", "caller": "0x7ff64b5a2b9b", "parentcaller": "0x7ff64b5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x260800008000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 215 }, { "timestamp": "2026-05-28 23:34:30,561", "thread_id": "9456", "caller": "0x7ff64b634faa", "parentcaller": "0x7ff64b635b4a", "category": "misc", "api": "GetCommandLineA", "status": true, "return": "0x1bce4c05890", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5816,i,7984218614831481947,5522388298470254199,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5860 /prefetch:8" } ], "repeated": 0, "id": 216 }, { "timestamp": "2026-05-28 23:34:30,561", "thread_id": "9456", "caller": "0x7ff64b634fb7", "parentcaller": "0x7ff64b635b4a", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x1bce4c03ed6", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5816,i,7984218614831481947,5522388298470254199,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5860 /prefetch:8" } ], "repeated": 0, "id": 217 }, { "timestamp": "2026-05-28 23:34:30,561", "thread_id": "9456", "caller": "0x7ff64b5a2b9b", "parentcaller": "0x7ff64b5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x260800018000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 218 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634a67", "parentcaller": "0x7ff64b634607", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-localization-l1-2-1" }, { "name": "BaseAddress", "value": "0x7ffbc5420000" } ], "repeated": 0, "id": 219 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634a67", "parentcaller": "0x7ff64b634607", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc5420000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-localization-l1-2-1" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 220 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b98", "parentcaller": "0x7ff64b634607", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5420000" }, { "name": "FunctionName", "value": "LCMapStringEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc543d3c0" } ], "repeated": 0, "id": 221 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b17", "parentcaller": "0x7ff64b634607", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff64b7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 222 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b48", "parentcaller": "0x7ff64b634607", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff64b7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 223 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5a2b9b", "parentcaller": "0x7ff64b5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x260800028000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 224 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5a2b9b", "parentcaller": "0x7ff64b5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x26080002c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 225 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b63b002", "parentcaller": "0x7ff64b625732", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c26000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 226 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5a2b9b", "parentcaller": "0x7ff64b5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x260800038000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 227 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5a2b9b", "parentcaller": "0x7ff64b5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x26080003c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 228 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5a2b9b", "parentcaller": "0x7ff64b5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x260800048000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 229 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5a2b9b", "parentcaller": "0x7ff64b5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x26080004c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 230 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5a2b9b", "parentcaller": "0x7ff64b5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x26080005c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 231 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5a2b9b", "parentcaller": "0x7ff64b5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x26080006c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 232 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5a2b9b", "parentcaller": "0x7ff64b5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x260800070000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 233 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5a2b9b", "parentcaller": "0x7ff64b5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x260800080000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 234 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5a2b9b", "parentcaller": "0x7ff64b5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x26080008c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 235 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5a2b9b", "parentcaller": "0x7ff64b5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x260800098000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 236 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5a2b9b", "parentcaller": "0x7ff64b5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x26080009c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 237 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5a2b9b", "parentcaller": "0x7ff64b5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2608000ac000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 238 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5c2d71", "parentcaller": "0x7ff64b625bf2", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc6480000" } ], "repeated": 0, "id": 239 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5c2d81", "parentcaller": "0x7ff64b625bf2", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7ffbc6480000" }, { "name": "FunctionName", "value": "GetSystemTimePreciseAsFileTime" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc64a5350" } ], "repeated": 0, "id": 240 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5a2b9b", "parentcaller": "0x7ff64b5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2608000b4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 241 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5a2b9b", "parentcaller": "0x7ff64b5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2608000b8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 242 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634a67", "parentcaller": "0x7ff64b634834", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32" }, { "name": "BaseAddress", "value": "0x7ffbc6480000" } ], "repeated": 0, "id": 243 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634a67", "parentcaller": "0x7ff64b634834", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc6480000", "arguments": [ { "name": "lpLibFileName", "value": "kernel32" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 244 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b98", "parentcaller": "0x7ff64b634834", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7ffbc6480000" }, { "name": "FunctionName", "value": "AreFileApisANSI" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc64a0f00" } ], "repeated": 0, "id": 245 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b17", "parentcaller": "0x7ff64b634834", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff64b7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 246 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b48", "parentcaller": "0x7ff64b634834", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff64b7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 247 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634a67", "parentcaller": "0x7ff64b634839", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-string-l1-1-0" }, { "name": "BaseAddress", "value": "0x7ffbc5420000" } ], "repeated": 0, "id": 248 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634a67", "parentcaller": "0x7ff64b634839", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc5420000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-string-l1-1-0" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 249 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b98", "parentcaller": "0x7ff64b634839", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5420000" }, { "name": "FunctionName", "value": "CompareStringEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc5447130" } ], "repeated": 0, "id": 250 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b17", "parentcaller": "0x7ff64b634839", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff64b7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 251 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b48", "parentcaller": "0x7ff64b634839", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff64b7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 252 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b98", "parentcaller": "0x7ff64b634862", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5420000" }, { "name": "FunctionName", "value": "EnumSystemLocalesEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc54a7f40" } ], "repeated": 0, "id": 253 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b17", "parentcaller": "0x7ff64b634862", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff64b7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 254 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b48", "parentcaller": "0x7ff64b634862", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff64b7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 255 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634a67", "parentcaller": "0x7ff64b63488b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-datetime-l1-1-1" }, { "name": "BaseAddress", "value": "0x7ffbc5420000" } ], "repeated": 0, "id": 256 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634a67", "parentcaller": "0x7ff64b63488b", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc5420000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-datetime-l1-1-1" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 257 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b98", "parentcaller": "0x7ff64b63488b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5420000" }, { "name": "FunctionName", "value": "GetDateFormatEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc54955b0" } ], "repeated": 0, "id": 258 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b17", "parentcaller": "0x7ff64b63488b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff64b7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 259 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b48", "parentcaller": "0x7ff64b63488b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff64b7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 260 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b98", "parentcaller": "0x7ff64b6348b4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5420000" }, { "name": "FunctionName", "value": "GetLocaleInfoEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc5440210" } ], "repeated": 0, "id": 261 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b17", "parentcaller": "0x7ff64b6348b4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff64b7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 262 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b48", "parentcaller": "0x7ff64b6348b4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff64b7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 263 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b98", "parentcaller": "0x7ff64b6348dd", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5420000" }, { "name": "FunctionName", "value": "GetTimeFormatEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc549d1a0" } ], "repeated": 0, "id": 264 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b17", "parentcaller": "0x7ff64b6348dd", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff64b7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 265 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b48", "parentcaller": "0x7ff64b6348dd", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff64b7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 266 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b98", "parentcaller": "0x7ff64b634906", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5420000" }, { "name": "FunctionName", "value": "GetUserDefaultLocaleName" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc545ae80" } ], "repeated": 0, "id": 267 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b17", "parentcaller": "0x7ff64b634906", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff64b7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 268 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b48", "parentcaller": "0x7ff64b634906", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff64b7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 269 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b98", "parentcaller": "0x7ff64b63492f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5420000" }, { "name": "FunctionName", "value": "IsValidLocaleName" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc543ad90" } ], "repeated": 0, "id": 270 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b17", "parentcaller": "0x7ff64b63492f", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff64b7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 271 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b48", "parentcaller": "0x7ff64b63492f", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff64b7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 272 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634a67", "parentcaller": "0x7ff64b634981", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-localization-obsolete-l1-2-0" }, { "name": "BaseAddress", "value": "0x7ffbc5420000" } ], "repeated": 0, "id": 273 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634a67", "parentcaller": "0x7ff64b634981", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc5420000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-localization-obsolete-l1-2-0" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 274 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b98", "parentcaller": "0x7ff64b634981", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5420000" }, { "name": "FunctionName", "value": "LCIDToLocaleName" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc543ae60" } ], "repeated": 0, "id": 275 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b17", "parentcaller": "0x7ff64b634981", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff64b7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 276 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b48", "parentcaller": "0x7ff64b634981", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff64b7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 277 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b98", "parentcaller": "0x7ff64b6349aa", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5420000" }, { "name": "FunctionName", "value": "LocaleNameToLCID" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc5490070" } ], "repeated": 0, "id": 278 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b17", "parentcaller": "0x7ff64b6349aa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff64b7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 279 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b634b48", "parentcaller": "0x7ff64b6349aa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff64b7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 280 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5c6e14", "parentcaller": "0x7ff64b5c6b29", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" } ], "repeated": 0, "id": 281 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5c6e24", "parentcaller": "0x7ff64b5c6b29", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlGetDeviceFamilyInfoEnum" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7b8f850" } ], "repeated": 0, "id": 282 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5c6e44", "parentcaller": "0x7ff64b5c6b29", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000240" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM" } ], "repeated": 0, "id": 283 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5c6e44", "parentcaller": "0x7ff64b5c6b29", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000240" }, { "name": "ValueName", "value": "DeviceForm" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\OEM\\DeviceForm" } ], "repeated": 0, "id": 284 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5c6e44", "parentcaller": "0x7ff64b5c6b29", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 285 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b6768ce", "parentcaller": "0x7ff64b55ad91", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x1bce4c03ed6", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5816,i,7984218614831481947,5522388298470254199,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5860 /prefetch:8" } ], "repeated": 0, "id": 286 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5f4315", "parentcaller": "0x7ff64b67692b", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x7ffbc5c20000" } ], "repeated": 0, "id": 287 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5f4315", "parentcaller": "0x7ff64b67692b", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 288 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5f4315", "parentcaller": "0x7ff64b67692b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-downlevel-shell32-l1-1-0.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5c20000" } ], "repeated": 0, "id": 289 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5f4315", "parentcaller": "0x7ff64b67692b", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc5c20000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-downlevel-shell32-l1-1-0.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 290 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5f4331", "parentcaller": "0x7ff64b67692b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "shcore.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5c20000" }, { "name": "FunctionName", "value": "CommandLineToArgvW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc5c3eb30" } ], "repeated": 0, "id": 291 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5f4348", "parentcaller": "0x7ff64b67692b", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x1bce4c25220", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5816,i,7984218614831481947,5522388298470254199,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5860 /prefetch:8" }, { "name": "NumArgs", "value": "13" } ], "repeated": 0, "id": 292 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5a2b9b", "parentcaller": "0x7ff64b5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2608000c0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 293 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5a2b9b", "parentcaller": "0x7ff64b5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2608000d0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 294 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5a2b9b", "parentcaller": "0x7ff64b5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2608000dc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 295 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5f4398", "parentcaller": "0x7ff64b67692b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 296 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5f4398", "parentcaller": "0x7ff64b67692b", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" } ], "repeated": 0, "id": 297 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5f4398", "parentcaller": "0x7ff64b67692b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bb3410" } ], "repeated": 0, "id": 298 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5f4398", "parentcaller": "0x7ff64b67692b", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x7ffbc5c20000" } ], "repeated": 0, "id": 299 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5f4398", "parentcaller": "0x7ff64b67692b", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc5c20000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 300 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5a2b20", "parentcaller": "0x7ff64b5a1bb6", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2608000b8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 301 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5a2b20", "parentcaller": "0x7ff64b5a1bb6", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2608000dc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 302 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b55ade6", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc6480000" } ], "repeated": 0, "id": 303 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b55adf6", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7ffbc6480000" }, { "name": "FunctionName", "value": "WerRegisterCustomMetadata" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc64bbbf0" } ], "repeated": 0, "id": 304 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b55ae16", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce6710000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 305 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b55ae16", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 306 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b55ae16", "parentcaller": "0x7ff64b614f22", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 307 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b55ae16", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" }, { "name": "Milliseconds", "value": "4000" } ], "repeated": 0, "id": 308 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b55ae16", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce6720000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 309 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b55ae16", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 310 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b55ae81", "parentcaller": "0x7ff64b614f22", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 311 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b55ae81", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" }, { "name": "Milliseconds", "value": "4000" } ], "repeated": 0, "id": 312 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b55ae81", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 313 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b55af7f", "parentcaller": "0x7ff64b614f22", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 314 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b55af7f", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" }, { "name": "Milliseconds", "value": "4000" } ], "repeated": 0, "id": 315 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b55af7f", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 316 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5a2b9b", "parentcaller": "0x7ff64b5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2608000e8000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 317 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5a2b20", "parentcaller": "0x7ff64b5a1bb6", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2608000c0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 318 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5a2b20", "parentcaller": "0x7ff64b5a1bb6", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2608000e8000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 319 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5f5da1", "parentcaller": "0x7ff64b709e0b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000023c" } ], "repeated": 0, "id": 320 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5cab91", "parentcaller": "0x7ff64b576aa9", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "bcryptprimitives.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5750000" } ], "repeated": 0, "id": 321 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5cab91", "parentcaller": "0x7ff64b576aa9", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc5750000", "arguments": [ { "name": "lpLibFileName", "value": "bcryptprimitives.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 322 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5cabaa", "parentcaller": "0x7ff64b576aa9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "bcryptprimitives.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5750000" }, { "name": "FunctionName", "value": "ProcessPrng" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc5765010" } ], "repeated": 0, "id": 323 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5a2b9b", "parentcaller": "0x7ff64b5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2608000c0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 324 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5cb5e6", "parentcaller": "0x7ff64b5f308f", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\148.0.3967.83\\msedge.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 325 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5cb5e6", "parentcaller": "0x7ff64b5f308f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000023c" }, { "name": "DesiredAccess", "value": "0xa0100080", "pretty_value": "GENERIC_READ|GENERIC_EXECUTE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 326 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5cba1c", "parentcaller": "0x7ff64b5cbc6d", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000238" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000023c" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge.dll" } ], "repeated": 0, "id": 327 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5cba51", "parentcaller": "0x7ff64b5cbc6d", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x00000238" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bceb000000" }, { "name": "SectionOffset", "value": "0x445d72f410" }, { "name": "ViewSize", "value": "0x136be000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 328 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5cbe04", "parentcaller": "0x7ff64b5cc9a4", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc6480000" } ], "repeated": 0, "id": 329 }, { "timestamp": "2026-05-28 23:34:30,577", "thread_id": "9456", "caller": "0x7ff64b5cbe14", "parentcaller": "0x7ff64b5cc9a4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7ffbc6480000" }, { "name": "FunctionName", "value": "PrefetchVirtualMemory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc54a6590" } ], "repeated": 0, "id": 330 }, { "timestamp": "2026-05-28 23:34:30,592", "thread_id": "9456", "caller": "0x7ff64b5cbd36", "parentcaller": "0x7ff64b5f1e1d", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bceb000000" }, { "name": "RegionSize", "value": "0x136be000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 331 }, { "timestamp": "2026-05-28 23:34:30,592", "thread_id": "9456", "caller": "0x7ff64b5c698c", "parentcaller": "0x7ff64b574c5a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "ModuleHandle", "value": "0x7ff64b540000" }, { "name": "FunctionName", "value": "GetHandleVerifier" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff64b5c6850" } ], "repeated": 0, "id": 332 }, { "timestamp": "2026-05-28 23:34:30,592", "thread_id": "9456", "caller": "0x7ff64b5a2b9b", "parentcaller": "0x7ff64b5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2608000f8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 333 }, { "timestamp": "2026-05-28 23:34:30,592", "thread_id": "9456", "caller": "0x7ff64b574cc2", "parentcaller": "0x7ff64b5cbd52", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "71" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 334 }, { "timestamp": "2026-05-28 23:34:30,592", "thread_id": "9456", "caller": "0x7ff64b574cc2", "parentcaller": "0x7ff64b5cbd52", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" } ], "repeated": 0, "id": 335 }, { "timestamp": "2026-05-28 23:34:30,592", "thread_id": "9456", "caller": "0x7ff64b574cc2", "parentcaller": "0x7ff64b576db8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000023c" } ], "repeated": 0, "id": 336 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b3c0", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge" }, { "name": "DllBase", "value": "0x1bceb000000" } ], "repeated": 0, "id": 337 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b3c0", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-fibers-l1-1-2" }, { "name": "BaseAddress", "value": "0x7ffbc5420000" } ], "repeated": 0, "id": 338 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b3c0", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "bcryptprimitives.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5750000" } ], "repeated": 0, "id": 339 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b3c0", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-localization-l1-2-1" }, { "name": "BaseAddress", "value": "0x7ffbc5420000" } ], "repeated": 0, "id": 340 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b3c0", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32" }, { "name": "BaseAddress", "value": "0x7ffbc6480000" } ], "repeated": 0, "id": 341 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b3c0", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-string-l1-1-0" }, { "name": "BaseAddress", "value": "0x7ffbc5420000" } ], "repeated": 0, "id": 342 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b3c0", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-datetime-l1-1-1" }, { "name": "BaseAddress", "value": "0x7ffbc5420000" } ], "repeated": 0, "id": 343 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b3c0", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-localization-obsolete-l1-2-0" }, { "name": "BaseAddress", "value": "0x7ffbc5420000" } ], "repeated": 0, "id": 344 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b3c0", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "bcryptprimitives.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5750000" } ], "repeated": 0, "id": 345 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b3c0", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge.dll" }, { "name": "BaseAddress", "value": "0x1bceb000000" } ], "repeated": 0, "id": 346 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b3c0", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x1bceb000000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge.dll" }, { "name": "dwFlags", "value": "0x00000008" } ], "repeated": 0, "id": 347 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b5f1", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x0000023c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x7ff64b55b680" }, { "name": "Parameter", "value": "0x00000000" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "9776" }, { "name": "ProcessId", "value": "9452" }, { "name": "Module", "value": "identity_helper.exe" } ], "repeated": 0, "id": 348 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b5f1", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x0000023c", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ff64b55b680" }, { "name": "Parameter", "value": "0x00000000" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "9776" }, { "name": "ProcessId", "value": "9452" } ], "repeated": 0, "id": 349 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b620", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "msedge.dll" }, { "name": "ModuleHandle", "value": "0x1bceb000000" }, { "name": "FunctionName", "value": "ChromeMain" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x1bcec30a5c0" } ], "repeated": 0, "id": 350 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880009c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 351 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x4388000ac000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 352 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x4388000b8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 353 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x4388000c4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 354 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9776", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x4388000d4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 355 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ucrtbase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc57e0000" } ], "repeated": 0, "id": 356 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ucrtbase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc57e0000" }, { "name": "FunctionName", "value": "signal" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc58518e0" } ], "repeated": 0, "id": 357 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9776", "caller": "0x7ffbc7bc507d", "parentcaller": "0x7ffbc7bc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 358 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9776", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ff64b55b680" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 359 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x4388000d8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 360 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x4388000e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 361 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x4388000f0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 362 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800038000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 363 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800090000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 364 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ADVAPI32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc65a0000" } ], "repeated": 0, "id": 365 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc65a0000", "arguments": [ { "name": "lpLibFileName", "value": "ADVAPI32.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 366 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc65a0000" }, { "name": "FunctionName", "value": "EventRegister" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7b92e80" } ], "repeated": 0, "id": 367 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc65a0000" }, { "name": "FunctionName", "value": "EventSetInformation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7b92af0" } ], "repeated": 0, "id": 368 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800100000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 369 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\uxtheme" }, { "name": "DllBase", "value": "0x7ffbc2bf0000" } ], "repeated": 0, "id": 370 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800108000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 371 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\uxtheme.dll" }, { "name": "BaseAddress", "value": "0x7ffbc2bf0000" } ], "repeated": 0, "id": 372 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc2bf0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\system32\\uxtheme.dll" }, { "name": "dwFlags", "value": "0x00000008" } ], "repeated": 0, "id": 373 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "uxtheme.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc2bf0000" }, { "name": "FunctionName", "value": "ThemeInitApiHook" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc2bfcde0" } ], "repeated": 0, "id": 374 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 375 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xf1\\x1f^D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 376 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000260" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 377 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000260" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 378 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000258" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x1bcec2c9bd0" }, { "name": "Parameter", "value": "0x43880006c100" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "9784" }, { "name": "ProcessId", "value": "9452" }, { "name": "Module", "value": "msedge.dll" } ], "repeated": 0, "id": 379 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000258", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x1bcec2c9bd0" }, { "name": "Parameter", "value": "0x43880006c100" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "9784" }, { "name": "ProcessId", "value": "9452" } ], "repeated": 0, "id": 380 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000268" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000260" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 381 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880002d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 382 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ffbc548156c", "parentcaller": "0x1bcec33f46c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "ModuleHandle", "value": "0x7ff64b540000" }, { "name": "FunctionName", "value": "GetHandleVerifier" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff64b5c6850" } ], "repeated": 0, "id": 383 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" }, { "name": "ValueName", "value": "AppsUseLightTheme" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme" } ], "repeated": 0, "id": 384 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880010c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 385 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880011c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 386 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" } ], "repeated": 0, "id": 387 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9784", "caller": "0x7ffbc7bc507d", "parentcaller": "0x7ffbc7bc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 388 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9784", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x1bcec2c9bd0" }, { "name": "Parameter", "value": "0x43880006c100" } ], "repeated": 0, "id": 389 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9784", "caller": "0x7ffbc5486f4c", "parentcaller": "0x1bcec2c9c51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000026c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 390 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9784", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ffe48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x468a81ad1000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 391 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9784", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800204000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 392 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9784", "caller": "0x7ffbc544e76a", "parentcaller": "0x1bcec2cef1b", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "Kernel32.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc6480000" } ], "repeated": 0, "id": 393 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9784", "caller": "0x7ffbc548156c", "parentcaller": "0x1bcec2cef2b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7ffbc6480000" }, { "name": "FunctionName", "value": "SetThreadDescription" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc54939c0" } ], "repeated": 0, "id": 394 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9784", "caller": "0x1bcec2ceecc", "parentcaller": "0x1bcec30a10d", "category": "threading", "api": "SetThreadDescription", "status": true, "return": "0x10000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadDescription", "value": "LoaderLockSampler" } ], "repeated": 0, "id": 395 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9784", "caller": "0x1bcec2ceee8", "parentcaller": "0x1bcec30a10d", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 396 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9784", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880002a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 397 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000268" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\icudtl.dat" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 398 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000278" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "MSCTF.dll" } ], "repeated": 0, "id": 399 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000278" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7690000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00114000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 400 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc77a0000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 401 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000274" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000268" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\icudtl.dat" } ], "repeated": 0, "id": 402 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc776c000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 403 }, { "timestamp": "2026-05-28 23:34:30,608", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc776b000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 404 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000278" } ], "repeated": 0, "id": 405 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc776b000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 406 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "35" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x02\\x00\\x00\\x00g\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00i\\x00l\\x00e\\x00s\\x00\\x02\\x00\\x00\\x00x\\x008\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00i\\x00c\\x00r\\x00o\\x00\\x02\\x00\\x00\\x00f\\x00t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00e\\x00\\\\x00A\\x00p\\x00\\x02\\x00\\x00\\x00i\\x00c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00n\\x00\\\\x001\\x004\\x00\\x02\\x00\\x00\\x000\\x00.\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00.\\x008\\x003\\x00\\\\x00\\x02\\x00\\x00\\x00u\\x00d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00a\\x00t\\x00\\x00\\x00\\x02\\x00\\x02\\x00\\x00\\x00_Q\\xb9\\xc9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 407 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\MSCTF" }, { "name": "DllBase", "value": "0x7ffbc7690000" } ], "repeated": 0, "id": 408 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000268" }, { "name": "HandleName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\icudtl.dat" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x000\\xbe\\x00\\x00\\x00\\x00\\x00\\x00%\\xbe\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 409 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000274" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bcfe6c0000" }, { "name": "SectionOffset", "value": "0x445d72e5e0" }, { "name": "ViewSize", "value": "0x00be3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 410 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\msctf" }, { "name": "BaseAddress", "value": "0x7ffbc7690000" }, { "name": "InitRoutine", "value": "0x7ffbc76d0760" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 411 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7559000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 412 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7559000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 413 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000027c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\v8_context_snapshot.bin" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 414 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000288" } ], "repeated": 0, "id": 415 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" } ], "repeated": 0, "id": 416 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7559000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 417 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7559000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 418 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc6d38000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 419 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc6d38000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 420 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000028c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" } ], "repeated": 0, "id": 421 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000028c" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US" } ], "repeated": 0, "id": 422 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" } ], "repeated": 0, "id": 423 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000028c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" } ], "repeated": 0, "id": 424 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000028c" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US" } ], "repeated": 0, "id": 425 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" } ], "repeated": 0, "id": 426 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000288" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "\\Sessions\\1\\Windows\\ThemeSection" } ], "repeated": 0, "id": 427 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000027c" }, { "name": "HandleName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\v8_context_snapshot.bin" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00@\\x0b\\x00\\x00\\x00\\x00\\x00\\x88=\\x0b\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 428 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000288" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce6740000" }, { "name": "SectionOffset", "value": "0x445e1fe750" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 429 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000284" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce6f00000" }, { "name": "SectionOffset", "value": "0x445d72ec30" }, { "name": "ViewSize", "value": "0x000b4000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 430 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000294" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "\\Sessions\\1\\Windows\\Theme849711568" } ], "repeated": 0, "id": 431 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce6740000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 432 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000288" } ], "repeated": 0, "id": 433 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000290" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce9440000" }, { "name": "SectionOffset", "value": "0x445e1fee70" }, { "name": "ViewSize", "value": "0x000e2000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 434 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000294" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce6740000" }, { "name": "SectionOffset", "value": "0x445e1fee70" }, { "name": "ViewSize", "value": "0x00004000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 435 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" } ], "repeated": 0, "id": 436 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7b593b0" } ], "repeated": 0, "id": 437 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7befc40" } ], "repeated": 0, "id": 438 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7b92460" } ], "repeated": 0, "id": 439 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000028c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_100_percent.pak" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 440 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 441 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000029c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 442 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 443 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 444 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a0" } ], "repeated": 0, "id": 445 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000029c" } ], "repeated": 0, "id": 446 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000288" } ], "repeated": 0, "id": 447 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9776", "caller": "0x7ff64b55b737", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000288" } ], "repeated": 0, "id": 448 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000298" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000028c" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_100_percent.pak" } ], "repeated": 0, "id": 449 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000028c" }, { "name": "HandleName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_100_percent.pak" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xb0\\x13\\x00\\x00\\x00\\x00\\x00\\xf7\\xa4\\x13\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 450 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000298" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce9800000" }, { "name": "SectionOffset", "value": "0x445d72e390" }, { "name": "ViewSize", "value": "0x0013b000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 451 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000029c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_200_percent.pak" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 452 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002a0" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000029c" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_200_percent.pak" } ], "repeated": 0, "id": 453 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000029c" }, { "name": "HandleName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_200_percent.pak" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00`\\x1e\\x00\\x00\\x00\\x00\\x00cY\\x1e\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 454 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002a0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce9940000" }, { "name": "SectionOffset", "value": "0x445d72e390" }, { "name": "ViewSize", "value": "0x001e6000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 455 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880012c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 456 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880012d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 457 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800138000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 458 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800140000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 459 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x4388000e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 460 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880011c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 461 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800138000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 462 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800148000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 463 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800140000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 464 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x4388000e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 465 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880011c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 466 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800138000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 467 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800140000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 468 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880014c000" }, { "name": "RegionSize", "value": "0x0000e000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 469 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x4388000e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 470 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800138000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 471 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800140000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 472 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880015c000" }, { "name": "RegionSize", "value": "0x0000a000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 473 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880014c000" }, { "name": "RegionSize", "value": "0x0000e000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 474 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800125000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 475 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\Locales" } ], "repeated": 0, "id": 476 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\Locales\\en-US.pak" } ], "repeated": 0, "id": 477 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\Locales\\en-US.pak" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 478 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002ac" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002a8" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\Locales\\en-US.pak" } ], "repeated": 0, "id": 479 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a8" }, { "name": "HandleName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\Locales\\en-US.pak" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00`\r\\x00\\x00\\x00\\x00\\x00 U\r\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 480 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002ac" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce9b30000" }, { "name": "SectionOffset", "value": "0x445d72e3a0" }, { "name": "ViewSize", "value": "0x000d6000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 481 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\resources.pak" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 482 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002b4" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002b0" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\resources.pak" } ], "repeated": 0, "id": 483 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002b0" }, { "name": "HandleName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\resources.pak" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00P\\x1d\\x02\\x00\\x00\\x00\\x00LA\\x1d\\x02\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 484 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002b4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bc80000000" }, { "name": "SectionOffset", "value": "0x445d72e4a0" }, { "name": "ViewSize", "value": "0x021d5000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 485 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800168000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 486 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880000a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 487 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc65a0000" }, { "name": "FunctionName", "value": "RegisterTraceGuidsW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7b92a10" } ], "repeated": 0, "id": 488 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc65a0000" }, { "name": "FunctionName", "value": "OpenProcessToken" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc65b6ac0" } ], "repeated": 0, "id": 489 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002bc" } ], "repeated": 0, "id": 490 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc65a0000" }, { "name": "FunctionName", "value": "GetTokenInformation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc65b61d0" } ], "repeated": 0, "id": 491 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 492 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xc7\\x04\\x00\\x88C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 493 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc65a0000" }, { "name": "FunctionName", "value": "IsValidSid" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc65b6d80" } ], "repeated": 0, "id": 494 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc65a0000" }, { "name": "FunctionName", "value": "GetLengthSid" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc65b68c0" } ], "repeated": 0, "id": 495 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc65a0000" }, { "name": "FunctionName", "value": "ConvertSidToStringSidW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc65b5a70" } ], "repeated": 0, "id": 496 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b574c88", "parentcaller": "0x7ff64b55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002bc" } ], "repeated": 0, "id": 497 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 498 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 499 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 500 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 501 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" } ], "repeated": 0, "id": 502 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlGetDeviceFamilyInfoEnum" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7b8f850" } ], "repeated": 0, "id": 503 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002bc" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM" } ], "repeated": 0, "id": 504 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002bc" }, { "name": "ValueName", "value": "DeviceForm" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\OEM\\DeviceForm" } ], "repeated": 0, "id": 505 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002bc" } ], "repeated": 0, "id": 506 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "USER32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc77b0000" } ], "repeated": 0, "id": 507 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc77b0000", "arguments": [ { "name": "lpLibFileName", "value": "USER32.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 508 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "USER32.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc77b0000" }, { "name": "FunctionName", "value": "PostThreadMessageW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc77d7ee0" } ], "repeated": 0, "id": 509 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "windows", "api": "PostThreadMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessId", "value": "9452" }, { "name": "ThreadId", "value": "9456" }, { "name": "Message", "value": "0" } ], "repeated": 0, "id": 510 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "USER32.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc77b0000" }, { "name": "FunctionName", "value": "PeekMessageW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc77ba3e0" } ], "repeated": 0, "id": 511 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" } ], "repeated": 0, "id": 512 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "NtQuerySection" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bed9f0" } ], "repeated": 0, "id": 513 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtDuplicateObject", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000914" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000000" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 514 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 515 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "1", "pretty_value": "FILE_OPEN" } ], "repeated": 0, "id": 516 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "api-ms-win-core-wow64-l1-1-1.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5420000" } ], "repeated": 0, "id": 517 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5420000" }, { "name": "FunctionName", "value": "IsWow64Process2" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc54970e0" } ], "repeated": 0, "id": 518 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc65a0000" }, { "name": "FunctionName", "value": "RegOpenKeyExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc65b6180" } ], "repeated": 0, "id": 519 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" }, { "name": "Handle", "value": "0x000002bc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" } ], "repeated": 0, "id": 520 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc65a0000" }, { "name": "FunctionName", "value": "RegQueryValueExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc65b6160" } ], "repeated": 0, "id": 521 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002bc" }, { "name": "ValueName", "value": "UBR" }, { "name": "Data", "value": "3803" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\UBR" } ], "repeated": 0, "id": 522 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002bc" }, { "name": "ValueName", "value": "DisplayVersion" }, { "name": "Data", "value": "22H2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion" } ], "repeated": 0, "id": 523 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc65a0000" }, { "name": "FunctionName", "value": "RegCloseKey" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc65b6930" } ], "repeated": 0, "id": 524 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002bc" } ], "repeated": 0, "id": 525 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc6480000" } ], "repeated": 0, "id": 526 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7ffbc6480000" }, { "name": "FunctionName", "value": "IsWow64Process2" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc54970e0" } ], "repeated": 0, "id": 527 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000914" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce6760000" }, { "name": "SectionOffset", "value": "0x445d72ec80" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 528 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce6760000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 529 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b574c88", "parentcaller": "0x7ff64b55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000914" } ], "repeated": 0, "id": 530 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000016b8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000914" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 531 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000914" } ], "repeated": 0, "id": 532 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000016b8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce6760000" }, { "name": "SectionOffset", "value": "0x445d72eb70" }, { "name": "ViewSize", "value": "0x00080000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 533 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b574c88", "parentcaller": "0x7ff64b55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000016b8" } ], "repeated": 0, "id": 534 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtDuplicateObject", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000910" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000000" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 535 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000910" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce6fc0000" }, { "name": "SectionOffset", "value": "0x445d72e970" }, { "name": "ViewSize", "value": "0x00040000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 536 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x4388000d5000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 537 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800059000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 538 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x4388000d6000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 539 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880004d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 540 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x4388000d7000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 541 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880005a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 542 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800049000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 543 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880017c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 544 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880017d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 545 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880005b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 546 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880004e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 547 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b574c88", "parentcaller": "0x7ff64b55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000910" } ], "repeated": 0, "id": 548 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800180000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 549 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800005000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 550 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x000002bc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x1bcec2c9bd0" }, { "name": "Parameter", "value": "0x43880006c310" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "9792" }, { "name": "ProcessId", "value": "9452" }, { "name": "Module", "value": "msedge.dll" } ], "repeated": 0, "id": 551 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x000002bc", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x1bcec2c9bd0" }, { "name": "Parameter", "value": "0x43880006c310" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "9792" }, { "name": "ProcessId", "value": "9452" } ], "repeated": 0, "id": 552 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800169000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 553 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x8d]D\\x00\\x00\\x00\\xec$\\x00\\x00\\x00\\x00\\x00\\x00\\xf0$\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9456" } ], "repeated": 0, "id": 554 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9792", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c39000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 555 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9792", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4d06000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 556 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800140000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 557 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 558 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9792", "caller": "0x7ffbc7bc507d", "parentcaller": "0x7ffbc7bc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 559 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9792", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x1bcec2c9bd0" }, { "name": "Parameter", "value": "0x43880006c310" } ], "repeated": 0, "id": 560 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9792", "caller": "0x7ffbc5486f4c", "parentcaller": "0x1bcec2c9c51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000002c4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 561 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800190000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 562 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9792", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800208000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 563 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9792", "caller": "0x7ffbc5481762", "parentcaller": "0x1bceb2bd9a5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800204000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 564 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800191000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 565 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9792", "caller": "0x1bcec2ceecc", "parentcaller": "0x1bcec30a10d", "category": "threading", "api": "SetThreadDescription", "status": true, "return": "0x10000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadDescription", "value": "PerfettoTrace" } ], "repeated": 0, "id": 566 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800194000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 567 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9792", "caller": "0x1bcec2ceee8", "parentcaller": "0x1bcec30a10d", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 568 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800197000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 569 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9792", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800192000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 570 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880005d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 571 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880019a000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 572 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9792", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800193000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 573 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9792", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x4388001a0000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 574 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880019d000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 575 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "Kernel32.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc6480000" } ], "repeated": 0, "id": 576 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7ffbc6480000" }, { "name": "FunctionName", "value": "GetThreadDescription" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc5548e60" } ], "repeated": 0, "id": 577 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "38" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00\\xbc\\x01\\x00\\x00\\x90\\x93\\xc0\\xe4\\xbc\\x01\\x00\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00 \\x00F\\x00i\\x00l\\x00e\\x00s\\x00 \\x00(\\x00x\\x008\\x006\\x00)\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00E\\x00d\\x00g\\x00e\\x00\\\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00\\\\x001\\x004\\x008\\x00.\\x000\\x00.\\x003\\x009\\x006\\x007\\x00.\\x008\\x003\\x00\\\\x00r\\x00e\\x00s\\x00o\\x00" }, { "name": "ThreadId", "value": "9456" } ], "repeated": 0, "id": 578 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "38" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x93\\xc0\\xe4\\xbc\\x01\\x00\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00 \\x00F\\x00i\\x00l\\x00e\\x00s\\x00 \\x00(\\x00x\\x008\\x006\\x00)\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00E\\x00d\\x00g\\x00e\\x00\\\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00\\\\x001\\x004\\x008\\x00.\\x000\\x00.\\x003\\x009\\x006\\x007\\x00.\\x008\\x003\\x00\\\\x00r\\x00e\\x00s\\x00o\\x00" }, { "name": "ThreadId", "value": "9456" } ], "repeated": 1, "id": 579 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc6480000" } ], "repeated": 0, "id": 580 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7ffbc6480000" }, { "name": "FunctionName", "value": "WerRegisterCustomMetadata" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc64bbbf0" } ], "repeated": 0, "id": 581 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 582 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 583 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 584 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 585 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 586 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 587 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 588 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 589 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 590 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 591 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 592 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 593 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 594 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" }, { "name": "Milliseconds", "value": "4000" } ], "repeated": 0, "id": 595 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 596 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 597 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 598 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 599 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" }, { "name": "Milliseconds", "value": "4000" } ], "repeated": 0, "id": 600 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 601 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 602 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 603 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 604 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 605 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 606 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 607 }, { "timestamp": "2026-05-28 23:34:30,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 608 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 609 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 610 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 611 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 612 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 613 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880012d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 614 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880016b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 615 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800197000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 616 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800165000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 617 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x468a818d3000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 618 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00002000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 619 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00004000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 620 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00004000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 621 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00008000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 622 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00014000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 623 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00014000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 624 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00008000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 625 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00008000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 626 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00014000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 627 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00014000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 628 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00008000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 629 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00008000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 630 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00024000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 631 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00030000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 632 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880020c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 633 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800208000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 634 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800210000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 635 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c0003c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 636 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00004000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 637 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00040000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 638 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00050000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 639 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00054000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 640 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x000002d8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x1bcec2c9bd0" }, { "name": "Parameter", "value": "0x438c00050200" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "9796" }, { "name": "ProcessId", "value": "9452" }, { "name": "Module", "value": "msedge.dll" } ], "repeated": 0, "id": 641 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x000002d8", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x1bcec2c9bd0" }, { "name": "Parameter", "value": "0x438c00050200" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "9796" }, { "name": "ProcessId", "value": "9452" } ], "repeated": 0, "id": 642 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 643 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 644 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 645 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9796", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x242000006000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 646 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9796", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800212000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 647 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9796", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00058000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 648 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9796", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00068000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 649 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9796", "caller": "0x7ffbc7bc507d", "parentcaller": "0x7ffbc7bc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 650 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9796", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x1bcec2c9bd0" }, { "name": "Parameter", "value": "0x438c00050200" } ], "repeated": 0, "id": 651 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9796", "caller": "0x7ffbc5486f4c", "parentcaller": "0x1bcec2c9c51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000002e0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 652 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9796", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c0006c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 653 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9796", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c0007c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 654 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9796", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c0008c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 655 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9796", "caller": "0x7ffbc5548ec6", "parentcaller": "0x1bcec2b0158", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "38" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xa5\\xc3\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9796" } ], "repeated": 0, "id": 656 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9796", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00090000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 657 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9796", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c0009c000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 658 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9796", "caller": "0x7ffbc5481762", "parentcaller": "0x1bceb2bd9a5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00090000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 659 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9796", "caller": "0x7ffbc5481762", "parentcaller": "0x1bceb2bd9a5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c0009c000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 660 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9796", "caller": "0x1bcec2ceecc", "parentcaller": "0x1bcec4f1293", "category": "threading", "api": "SetThreadDescription", "status": true, "return": "0x10000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadDescription", "value": "HangWatcher" } ], "repeated": 0, "id": 661 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9796", "caller": "0x1bcec2ceee8", "parentcaller": "0x1bcec4f1293", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 662 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9796", "caller": "0x7ffbc54430ce", "parentcaller": "0x1bcec20ee58", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 663 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9796", "caller": "0x7ffbc54430ce", "parentcaller": "0x1bcec20ee58", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" }, { "name": "Milliseconds", "value": "10000" } ], "repeated": 0, "id": 664 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00090000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 665 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c000ac000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 666 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "38" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xa5\\xc3\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9456" } ], "repeated": 0, "id": 667 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c0009c000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 668 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "SetThreadDescription", "status": true, "return": "0x10000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadDescription", "value": "winrt_app_id.CrUtilityMain" } ], "repeated": 0, "id": 669 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 670 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5d30000" } ], "repeated": 0, "id": 671 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc5d30000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 672 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x000002f8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x1bcec2c9bd0" }, { "name": "Parameter", "value": "0x438c00050160" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "9800" }, { "name": "ProcessId", "value": "9452" }, { "name": "Module", "value": "msedge.dll" } ], "repeated": 0, "id": 673 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x000002f8", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x1bcec2c9bd0" }, { "name": "Parameter", "value": "0x438c00050160" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "9800" }, { "name": "ProcessId", "value": "9452" } ], "repeated": 0, "id": 674 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9800", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c3b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 675 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c000b0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 676 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9800", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800213000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 677 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9800", "caller": "0x7ffbc7bc507d", "parentcaller": "0x7ffbc7bc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 678 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9800", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x1bcec2c9bd0" }, { "name": "Parameter", "value": "0x438c00050160" } ], "repeated": 0, "id": 679 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9800", "caller": "0x7ffbc5486f4c", "parentcaller": "0x1bcec2c9c51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000308" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 680 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9800", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880021c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 681 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9800", "caller": "0x7ffbc5481762", "parentcaller": "0x1bceb2bd9a5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880020c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 682 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9800", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00025000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 683 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9800", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c0008d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 684 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9800", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b530fd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4ba1000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 685 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9800", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c48000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 686 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9800", "caller": "0x7ffbc5548ec6", "parentcaller": "0x1bcec2b0158", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "38" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x8b\\xc4\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9800" } ], "repeated": 0, "id": 687 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9800", "caller": "0x1bcec2ceecc", "parentcaller": "0x1bcec30a10d", "category": "threading", "api": "SetThreadDescription", "status": true, "return": "0x10000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadDescription", "value": "ThreadPoolServiceThread" } ], "repeated": 0, "id": 688 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9800", "caller": "0x1bcec2ceee8", "parentcaller": "0x1bcec30a10d", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 689 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9800", "caller": "0x7ffbc54430ce", "parentcaller": "0x1bcec20eec1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000030c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 690 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000304" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x1bcec2c9bd0" }, { "name": "Parameter", "value": "0x438c00050140" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "9804" }, { "name": "ProcessId", "value": "9452" }, { "name": "Module", "value": "msedge.dll" } ], "repeated": 0, "id": 691 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000304", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x1bcec2c9bd0" }, { "name": "Parameter", "value": "0x438c00050140" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "9804" }, { "name": "ProcessId", "value": "9452" } ], "repeated": 0, "id": 692 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9804", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c3c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 693 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9804", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c49000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 694 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9804", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800215000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 695 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9804", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00069000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 696 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9804", "caller": "0x7ffbc7bc507d", "parentcaller": "0x7ffbc7bc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 697 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9804", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x1bcec2c9bd0" }, { "name": "Parameter", "value": "0x438c00050140" } ], "repeated": 0, "id": 698 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9804", "caller": "0x7ffbc5486f4c", "parentcaller": "0x1bcec2c9c51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000031c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 699 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9804", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c0006d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 700 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9804", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c0007d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 701 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9804", "caller": "0x7ffbc5548ec6", "parentcaller": "0x1bcec2b0158", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "38" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x8a\\xc4\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9804" } ], "repeated": 0, "id": 702 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9804", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c0009e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 703 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9804", "caller": "0x1bcec2ceecc", "parentcaller": "0x1bcec2ced3f", "category": "threading", "api": "SetThreadDescription", "status": true, "return": "0x10000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadDescription", "value": "ThreadPoolForegroundWorker" } ], "repeated": 0, "id": 704 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9804", "caller": "0x1bcec2ceee8", "parentcaller": "0x1bcec2ced3f", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 705 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9804", "caller": "0x7ffbc54430ce", "parentcaller": "0x1bcec254b81", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 706 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9804", "caller": "0x7ffbc54430ce", "parentcaller": "0x1bcec254b81", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" }, { "name": "Milliseconds", "value": "60341" } ], "repeated": 0, "id": 707 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000318" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x1bcec2c9bd0" }, { "name": "Parameter", "value": "0x438c00050100" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "9808" }, { "name": "ProcessId", "value": "9452" }, { "name": "Module", "value": "msedge.dll" } ], "repeated": 0, "id": 708 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000318", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x1bcec2c9bd0" }, { "name": "Parameter", "value": "0x438c00050100" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "9808" }, { "name": "ProcessId", "value": "9452" } ], "repeated": 0, "id": 709 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9808", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c3d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 710 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9808", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c3e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 711 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9808", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800216000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 712 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9808", "caller": "0x7ffbc7bc507d", "parentcaller": "0x7ffbc7bc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 713 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9808", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x1bcec2c9bd0" }, { "name": "Parameter", "value": "0x438c00050100" } ], "repeated": 0, "id": 714 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9808", "caller": "0x7ffbc548c6f3", "parentcaller": "0x7ffbc548c5aa", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x8e]D\\x00\\x00\\x00\\xec$\\x00\\x00\\x00\\x00\\x00\\x00P&\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9808" } ], "repeated": 0, "id": 715 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9808", "caller": "0x7ffbc548c728", "parentcaller": "0x7ffbc548c5aa", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "24" }, { "name": "ThreadInformation", "value": "\\x05\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9808" } ], "repeated": 0, "id": 716 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9808", "caller": "0x7ffbc548c752", "parentcaller": "0x7ffbc548c5aa", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "22" }, { "name": "ThreadInformation", "value": "\\x02\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9808" } ], "repeated": 0, "id": 717 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9808", "caller": "0x7ffbc548ebae", "parentcaller": "0x1bcebc4c4eb", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x8e]D\\x00\\x00\\x00\\xec$\\x00\\x00\\x00\\x00\\x00\\x00P&\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xfc\\xff\\xff\\xff" }, { "name": "ThreadId", "value": "9808" } ], "repeated": 0, "id": 718 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9808", "caller": "0x7ffbc5486f4c", "parentcaller": "0x1bcec2c9c51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000032c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 719 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9808", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c0008e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 720 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9808", "caller": "0x7ffbc5548ec6", "parentcaller": "0x1bcec2b0158", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "38" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x8f\\xc4\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9808" } ], "repeated": 0, "id": 721 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9808", "caller": "0x1bcec2ceecc", "parentcaller": "0x1bcec2ced3f", "category": "threading", "api": "SetThreadDescription", "status": true, "return": "0x10000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadDescription", "value": "ThreadPoolBackgroundWorker" } ], "repeated": 0, "id": 722 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9808", "caller": "0x1bcec2ceee8", "parentcaller": "0x1bcec2ced3f", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 723 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9808", "caller": "0x7ffbc54430ce", "parentcaller": "0x1bcec254b81", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 724 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9808", "caller": "0x7ffbc54430ce", "parentcaller": "0x1bcec254b81", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000314" }, { "name": "Milliseconds", "value": "60340" } ], "repeated": 0, "id": 725 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000328" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x1bcec2c9bd0" }, { "name": "Parameter", "value": "0x438c000500c0" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "9812" }, { "name": "ProcessId", "value": "9452" }, { "name": "Module", "value": "msedge.dll" } ], "repeated": 0, "id": 726 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000328", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x1bcec2c9bd0" }, { "name": "Parameter", "value": "0x438c000500c0" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "9812" }, { "name": "ProcessId", "value": "9452" } ], "repeated": 0, "id": 727 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c3f000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 728 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c000c0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 729 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4d07000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 730 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c000c4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 731 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x242000007000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 732 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00014000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 733 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c000d0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 734 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc7bc507d", "parentcaller": "0x7ffbc7bc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 735 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x1bcec2c9bd0" }, { "name": "Parameter", "value": "0x438c000500c0" } ], "repeated": 0, "id": 736 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc5486f4c", "parentcaller": "0x1bcec2c9c51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000033c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 737 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00009000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 738 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00015000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 739 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00026000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 740 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc5548ec6", "parentcaller": "0x1bcec2b0158", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "38" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x8e\\xc4\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9812" } ], "repeated": 0, "id": 741 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c000e0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 742 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c0009f000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 743 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x1bcec2ceecc", "parentcaller": "0x1bcec30a10d", "category": "threading", "api": "SetThreadDescription", "status": true, "return": "0x10000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadDescription", "value": "Chrome_ChildIOThread" } ], "repeated": 0, "id": 744 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x1bcec2ceee8", "parentcaller": "0x1bcec30a10d", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 745 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00006000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 746 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c000e8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 747 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c000ad000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 748 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c000b1000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 749 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c000f0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 750 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c000c1000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 751 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c000c2000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 752 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9792", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00100000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 753 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9792", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c0006e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 754 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c000c3000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 755 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00051000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 756 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c000e1000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 757 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00007000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 758 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c0000a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 759 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00104000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 760 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc54a0e99", "parentcaller": "0x1bcecad9c7a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "FileInformationClass", "value": "30", "pretty_value": "FileCompletionInformation" }, { "name": "FileInformation", "value": "@\\x03\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\r\\x00\\x8cC\\x00\\x00" } ], "repeated": 0, "id": 761 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00105000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 762 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c0006a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 763 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00108000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 764 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c0000b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 765 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c0010c000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 766 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00106000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 767 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00110000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 768 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc54553aa", "parentcaller": "0x1bcecad9b5f", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00P\\x00\\x00\\x00\\xe2\\xce2\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "80" } ], "repeated": 0, "id": 769 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00114000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 770 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 771 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "Milliseconds", "value": "8000" } ], "repeated": 0, "id": 772 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 773 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "Milliseconds", "value": "8000" } ], "repeated": 0, "id": 774 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc5455810", "parentcaller": "0x1bcecad9d2e", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00\\xc8\\x00\\x00\\x00G\\x0c+\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00E8\\xaeH\\xadO\\xbe\\xcf\\xedzj\\x9eH\\x0c\\x16\\xa9r\\xd1=\\x05\\x11\\xee\\xa5?a\\xeft8\\xa8\\xbd\\xbd/\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00x\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x008\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xbasC\\xaem!\\x80\\xa3r!\\xca\\x17\\x9ad\\x15'\\x10\\x00\\x00\\x00\\x88\\x01\\x00\\x00\\xe9\\xd32\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "4096" } ], "repeated": 0, "id": 775 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c000d1000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 776 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc5486f4c", "parentcaller": "0x1bceb444292", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000004" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000344" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 777 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc5456785", "parentcaller": "0x1bceb4442a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 778 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc548c386", "parentcaller": "0x7ffbc548c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000004" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce67e0000" }, { "name": "SectionOffset", "value": "0x445e8fead0" }, { "name": "ViewSize", "value": "0x00020000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 779 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ff64b574c88", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" } ], "repeated": 0, "id": 780 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc54553aa", "parentcaller": "0x1bcebca0093", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00@\\xd82\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "64" } ], "repeated": 0, "id": 781 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00055000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 782 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00016000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 783 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00120000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 784 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c0007e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 785 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c0012c000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 786 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc5455810", "parentcaller": "0x1bcec0cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "48" } ], "repeated": 0, "id": 787 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc54553aa", "parentcaller": "0x1bcec0cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00X\\x00\\x00\\x00\\xf2\\xd92\\x03\\x00\\x00\\x00\\x00\\x18\\x00\"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x05\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "88" } ], "repeated": 0, "id": 788 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc5481762", "parentcaller": "0x1bceb2bd9a5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00108000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 789 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc5481762", "parentcaller": "0x1bceb2bd9a5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c0010c000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 790 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc5481762", "parentcaller": "0x1bceb2bd9a5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00110000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 791 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc5455810", "parentcaller": "0x1bcec0cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x008\\x01\\x00\\x00\\x08\\xd42\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\xb0\\x00\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00H\\x00\\x00\\x008\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd7U\\x8dN\\x00\\x00\\x00\\x00\\xa8\\x0f\\xb2\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x05\\x00\\x00@\\x00\\x00\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "376" } ], "repeated": 0, "id": 792 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c000ae000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 793 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc54553aa", "parentcaller": "0x1bcec0cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00X\\x00\\x00\\x00\\x08\\xda2\\x03\\x00\\x00\\x00\\x00\\x18\\x00\"\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x05\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "88" } ], "repeated": 0, "id": 794 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc5455810", "parentcaller": "0x1bcec0cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00_\\xdf2\\x03\\x00\\x00\\x00\\x00\\x18\\x00#\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "64" } ], "repeated": 0, "id": 795 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c0008f000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 796 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc54553aa", "parentcaller": "0x1bcec0cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00\\xe8\\x00\\x00\\x00\\xec\\xdb2\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "232" } ], "repeated": 0, "id": 797 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc5455810", "parentcaller": "0x1bcec0cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000103", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00_\\xdf2\\x03\\x00\\x00\\x00\\x00\\x18\\x00#\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "64" } ], "repeated": 0, "id": 798 }, { "timestamp": "2026-05-28 23:34:30,639", "thread_id": "9812", "caller": "0x7ffbc54553aa", "parentcaller": "0x1bcec0cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00\\xa0\\x01\\x00\\x00\\xee\\xdb2\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\xb8\\x00\\x00\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\x00\\x00\\x00P\\x00\\x00\\x008\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x87\\x1bV\\x00\\x00\\x00\\x00i\\x98\\xac;\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc8\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "416" } ], "repeated": 0, "id": 799 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x7ffbc54553aa", "parentcaller": "0x1bcec0cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00\\xe8\\x00\\x00\\x00\\x81\\xdd2\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00y\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x06\\x00\\x00@\\x00\\x00\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "232" } ], "repeated": 0, "id": 800 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x7ffbc54553aa", "parentcaller": "0x1bcec0cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00\\xe8\\x00\\x00\\x00E\\xdf2\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00z\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x06\\x00\\x00@\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "232" } ], "repeated": 0, "id": 801 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x7ffbc5455810", "parentcaller": "0x1bcec0cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00X\\x00\\x00\\x00W\\xe42\\x03\\x00\\x00\\x00\\x00\\x18\\x00\"\\x00\\x00\\x00\\x00\\x00\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00)\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x07\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00p\\x00\\x00\\x00.\\xe52\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00y\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "200" } ], "repeated": 0, "id": 802 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c000e2000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 803 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x7ffbc54553aa", "parentcaller": "0x1bcec0cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00\\xe8\\x00\\x00\\x00\\xd5\\xe02\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00{\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x06\\x00\\x00@\\x00\\x00\\x00\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "232" } ], "repeated": 0, "id": 804 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00027000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 805 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c000a0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 806 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00108000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 807 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c0006f000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 808 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x7ffbc5455810", "parentcaller": "0x1bcec0cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000103", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00X\\x00\\x00\\x00W\\xe42\\x03\\x00\\x00\\x00\\x00\\x18\\x00\"\\x00\\x00\\x00\\x00\\x00\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00)\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x07\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00p\\x00\\x00\\x00.\\xe52\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00y\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "200" } ], "repeated": 0, "id": 809 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00070000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 810 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x7ffbc54553aa", "parentcaller": "0x1bcec0cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00\\xb8\\x00\\x00\\x00\\xd5\\xe02\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00@\\x00\\x00\\x008\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00B\\x1aQ\\x13\\x01\\x00\\x00\\x00k\\x98\\xac;\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "184" } ], "repeated": 0, "id": 811 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-winrt-l1-1-0.dll" }, { "name": "BaseAddress", "value": "0x7ffbc71d0000" } ], "repeated": 0, "id": 812 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc71d0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-winrt-l1-1-0.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 813 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" }, { "name": "FunctionName", "value": "RoInitialize" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc727dd80" } ], "repeated": 0, "id": 814 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x7ffbc54553aa", "parentcaller": "0x1bcec0cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x008\\x00\\x00\\x00\\xe2\\xe02\\x03\\x00\\x00\\x00\\x00\\x18\\x00$\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "56" } ], "repeated": 0, "id": 815 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x7ffbc5486f4c", "parentcaller": "0x1bceb444292", "category": "system", "api": "NtDuplicateObject", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000004" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000000" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 816 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x7ffbc5486f4c", "parentcaller": "0x1bceb444292", "category": "system", "api": "NtDuplicateObject", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000344" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000000" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 817 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\system32\\rpcss.dll" }, { "name": "ModuleHandle", "value": "0x00000000" } ], "repeated": 0, "id": 818 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x7ffbc5455810", "parentcaller": "0x1bcec0cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00X\\x00\\x00\\x00\\xf7\\xe92\\x03\\x00\\x00\\x00\\x00\\x18\\x00\"\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x00*\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00@\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "88" } ], "repeated": 0, "id": 819 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 820 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "kernel.appcore.dll" } ], "repeated": 0, "id": 821 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x7ffbc54553aa", "parentcaller": "0x1bcec0cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00\\xe8\\x00\\x00\\x00\\x91\\xe12\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00|\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00#\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00@\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "232" } ], "repeated": 0, "id": 822 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x7ffbc5455810", "parentcaller": "0x1bcec0cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000103", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00X\\x00\\x00\\x00\\xf7\\xe92\\x03\\x00\\x00\\x00\\x00\\x18\\x00\"\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x00*\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00@\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "88" } ], "repeated": 0, "id": 823 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x7ffbc54553aa", "parentcaller": "0x1bcec0cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x008\\x01\\x00\\x00\\xac\\xe12\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\xb0\\x00\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00H\\x00\\x00\\x008\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xaa\\xb1\\xd4T\\x00\\x00\\x00\\x00m\\x98\\xac;\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00%\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x07\\x00\\x00@\\x00\\x00\\x00&\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "312" } ], "repeated": 0, "id": 824 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000354" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000350" }, { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" } ], "repeated": 0, "id": 825 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x7ffbc5455810", "parentcaller": "0x1bcec0cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\xb5\\xed2\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00%\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "64" } ], "repeated": 0, "id": 826 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc311f000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 827 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3115000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 828 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x7ffbc54553aa", "parentcaller": "0x1bcec0cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x001\\xe32\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 829 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3115000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 830 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3115000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 831 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xf9\\xef2\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00)\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00{\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 832 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3115000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 833 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\kernel.appcore" }, { "name": "DllBase", "value": "0x7ffbc3110000" } ], "repeated": 0, "id": 834 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x7ffbc54553aa", "parentcaller": "0x1bcec0cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00\\xe8\\x00\\x00\\x008\\xe42\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00}\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x07\\x00\\x00@\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "232" } ], "repeated": 0, "id": 835 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x7ffbc5455810", "parentcaller": "0x1bcec0cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000103", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xf9\\xef2\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00)\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00{\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 836 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x7ffbc54553aa", "parentcaller": "0x1bcec0cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\xc1\\xe52\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "64" } ], "repeated": 0, "id": 837 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x7ffbc54553aa", "parentcaller": "0x1bcec0cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\xfa\\xe72\\x03\\x00\\x00\\x00\\x00\\x18\\x00#\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "64" } ], "repeated": 0, "id": 838 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x7ffbc54553aa", "parentcaller": "0x1bcec0cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xad\\xec2\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00|\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 839 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\kernel.appcore" }, { "name": "BaseAddress", "value": "0x7ffbc3110000" }, { "name": "InitRoutine", "value": "0x7ffbc3113f10" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 840 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x7ffbc54553aa", "parentcaller": "0x1bcec0cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\xb6\\xec2\\x03\\x00\\x00\\x00\\x00\\x18\\x00#\\x00\\x00\\x00\\x00\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "64" } ], "repeated": 0, "id": 841 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 842 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c40000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 843 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc712e000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 844 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc712e000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 845 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c41000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 846 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 847 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 848 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c4a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 849 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00109000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 850 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c0005a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 851 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c000e3000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 852 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c000b2000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 853 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtDuplicateObject", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000004" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000000" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 854 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtDuplicateObject", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000344" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000000" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 855 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000004" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce9530000" }, { "name": "SectionOffset", "value": "0x445d72cf20" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 856 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b574c88", "parentcaller": "0x7ff64b55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" } ], "repeated": 0, "id": 857 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000344" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce9540000" }, { "name": "SectionOffset", "value": "0x445d72cf20" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 858 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b574c88", "parentcaller": "0x7ff64b55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 859 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00121000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 860 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xb6\\xfa2\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00{\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 861 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x7ffbc5455810", "parentcaller": "0x1bcec0cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00\\xe8\\x00\\x00\\x00\\x84\\xfb2\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00|\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x05\\x00\\x00@\\x00\\x00\\x00,\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xd8\\x00\\x00\\x00\\x8b\\xfb2\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "2368" } ], "repeated": 0, "id": 862 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c0013c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 863 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x7ffbc5455810", "parentcaller": "0x1bcec0cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000103", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00\\xe8\\x00\\x00\\x00\\x84\\xfb2\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00|\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x05\\x00\\x00@\\x00\\x00\\x00,\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xd8\\x00\\x00\\x00\\x8b\\xfb2\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "2368" } ], "repeated": 0, "id": 864 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Classes\\CLSID\\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\\LocalServer32" }, { "name": "Handle", "value": "0x0000035c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\\LocalServer32" } ], "repeated": 0, "id": 865 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x7ffbc54553aa", "parentcaller": "0x1bcec0cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xf5\\xfc2\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00y\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 866 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-winrt-string-l1-1-0.dll" }, { "name": "BaseAddress", "value": "0x7ffbc71d0000" } ], "repeated": 0, "id": 867 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc71d0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-winrt-string-l1-1-0.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 868 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" }, { "name": "FunctionName", "value": "WindowsCreateStringReference" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7217ac0" } ], "repeated": 0, "id": 869 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x7ffbc54553aa", "parentcaller": "0x1bcec0cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\x0f\\xfd2\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00|\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 870 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x7ffbc54553aa", "parentcaller": "0x1bcec0cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00 \\xfd2\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00}\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 871 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" } ], "repeated": 0, "id": 872 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" }, { "name": "FunctionName", "value": "CLSIDFromOle1Class" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc727f760" } ], "repeated": 0, "id": 873 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000370" } ], "repeated": 0, "id": 874 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9812", "caller": "0x7ffbc54553aa", "parentcaller": "0x1bcec0cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00;\\xfd2\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 875 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xcdr]D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\xc0h\\x86\\xfb\\x7f\\x00\\x00\\xa0\\xbdh\\x86\\xfb\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffP\\xcer]D\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xc0h\\x86" } ], "repeated": 0, "id": 876 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000374" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\User\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes" } ], "repeated": 0, "id": 877 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" } ], "repeated": 0, "id": 878 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bb3410" } ], "repeated": 0, "id": 879 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "MutexName", "value": "Local\\SM0:9452:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 880 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 881 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 882 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 883 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 884 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000354" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 885 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000354" } ], "repeated": 0, "id": 886 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 887 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" } ], "repeated": 0, "id": 888 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" } ], "repeated": 0, "id": 889 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000370" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\__ComCatalogCache__" } ], "repeated": 0, "id": 890 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000370" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce9550000" }, { "name": "SectionOffset", "value": "0x445d72ce70" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 891 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c5b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 892 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\COM3" }, { "name": "Handle", "value": "0x00000378" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\COM3" } ], "repeated": 0, "id": 893 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" }, { "name": "ValueName", "value": "Com+Enabled" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled" } ], "repeated": 0, "id": 894 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 895 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 896 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000378" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "clbcatq.dll" } ], "repeated": 0, "id": 897 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000378" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7a60000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000a9000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 898 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7b04000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 899 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7ad9000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 900 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7ad9000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 901 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7ad9000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 902 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7ad9000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 903 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7ad8000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 904 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 905 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7ad8000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 906 }, { "timestamp": "2026-05-28 23:34:30,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\clbcatq" }, { "name": "DllBase", "value": "0x7ffbc7a60000" } ], "repeated": 0, "id": 907 }, { "timestamp": "2026-05-28 23:34:30,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtOpenEvent", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000354" }, { "name": "EventName", "value": "\\KernelObjects\\MaximumCommitCondition" } ], "repeated": 0, "id": 908 }, { "timestamp": "2026-05-28 23:34:30,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\clbcatq" }, { "name": "BaseAddress", "value": "0x7ffbc7a60000" }, { "name": "InitRoutine", "value": "0x7ffbc7a7d990" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 909 }, { "timestamp": "2026-05-28 23:34:30,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 910 }, { "timestamp": "2026-05-28 23:34:30,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 911 }, { "timestamp": "2026-05-28 23:34:30,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000358" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE\\Software\\Microsoft\\WindowsRuntime" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsRuntime" } ], "repeated": 0, "id": 912 }, { "timestamp": "2026-05-28 23:34:30,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000344" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000358" }, { "name": "ObjectAttributesName", "value": "ActivatableClassId" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId" } ], "repeated": 0, "id": 913 }, { "timestamp": "2026-05-28 23:34:30,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000004" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000344" }, { "name": "ObjectAttributesName", "value": "Windows.ApplicationModel.Background.BackgroundExecutionManager" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager" } ], "repeated": 0, "id": 914 }, { "timestamp": "2026-05-28 23:34:30,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000004" }, { "name": "KeyInformation", "value": "[\\xff9a\\xffe5\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00|\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00B\\x00a\\x00c\\x00k\\x00g\\x00r\\x00o\\x00u\\x00n\\x00d\\x00.\\x00B\\x00a\\x00c\\x00k\\x00g\\x00r\\x00o\\x00u\\x00n\\x00d\\x00E\\x00x\\x00e\\x00c\\x00u\\x00t\\x00i\\x00o\\x00n\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\xff87\\x00\\xfffb\\xff87\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\x00\\xfffb\\xff87\\xfffb\\x7f\\x00\\x00\\xfff8\\xffcar]D\\x00\\x00\\x00J\\x07Xv\r\\xff8a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xff8b\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\xffd0\\xffe4F\\xfffb\\xffbc\\x01\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\x19\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\xffe0w\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00@\\xffcbr]D\\x00\\x00\\x00\\xffe4IF\\xff86\\xfffb\\x7f\\x00\\x00\\xffd0\\xffe4F\\xfffb\\xffbc\\x01\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffffX\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xffb9\\x00\\xfffb\\xff87\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff9d\\xffd0h\\xff86\\xfffb\\x7f\\x00\\x00\\xffb8\\xffcfh\\xff86\\xfffb\\x7f\\x00\\x00\\xffe0w\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\xfff8\\xff81h\\xff86\\xfffb\\x7f\\x00\\x00\\x19\\x01\\x02\\x00\\xffbc\\x01\\x00\\x00h\\xffd0h\\xff86\\xfffb\\x7f\\x00\\x00X\\x03\\x00\\x00\\x00\\x00\\x00\\x00P\\xffd0h\\xff86\\xfffb\\x7f\\x00\\x000\\xffcbr]D\\x00\\x00\\x00\\xff98\\xff85h\\xff86\\xfffb\\x7f\\x00\\x00@\\xffcbr]D\\x00\\x00\\x00\\xffa0\\x15\\xffc3\\xffe4\\xffbc\\x01\\x00\\x00\\xffb0t\"\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00\\xffc0\\xffccr]D\\x00\\x00\\x00\\xffe0w\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\xff80\\xff8b\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x00&\\x00\\x00\\x00\\x00\\x00\\xffbc\\x15\\xffc3\\xffe4\\xffbc\\x01\\x00\\x000\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00X\\x03\\x00\\x00\\x00\\x00\\x00\\x000\\xffcbr]D\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0w\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\x19h\"\\xffc7\\xfffb\\x7f\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 915 }, { "timestamp": "2026-05-28 23:34:30,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivationType" } ], "repeated": 0, "id": 916 }, { "timestamp": "2026-05-28 23:34:30,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Server" } ], "repeated": 0, "id": 917 }, { "timestamp": "2026-05-28 23:34:30,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\execmodelclient.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\DllPath" } ], "repeated": 0, "id": 918 }, { "timestamp": "2026-05-28 23:34:30,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Threading" } ], "repeated": 0, "id": 919 }, { "timestamp": "2026-05-28 23:34:30,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\TrustLevel" } ], "repeated": 0, "id": 920 }, { "timestamp": "2026-05-28 23:34:30,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000004" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\CustomAttributes" } ], "repeated": 0, "id": 921 }, { "timestamp": "2026-05-28 23:34:30,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\RemoteServer" } ], "repeated": 0, "id": 922 }, { "timestamp": "2026-05-28 23:34:30,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateAsUser" } ], "repeated": 0, "id": 923 }, { "timestamp": "2026-05-28 23:34:30,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateInSharedBroker" } ], "repeated": 0, "id": 924 }, { "timestamp": "2026-05-28 23:34:30,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 925 }, { "timestamp": "2026-05-28 23:34:30,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Permissions" } ], "repeated": 0, "id": 926 }, { "timestamp": "2026-05-28 23:34:30,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateOnHostFlags" } ], "repeated": 0, "id": 927 }, { "timestamp": "2026-05-28 23:34:30,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\OLE\\Diagnosis" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\Diagnosis" } ], "repeated": 0, "id": 928 }, { "timestamp": "2026-05-28 23:34:30,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" } ], "repeated": 0, "id": 929 }, { "timestamp": "2026-05-28 23:34:30,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xcbr]D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xbc\\x01\\x00\\x00\\xe1\\xcdr]D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\xe4\\x16\\xf2]\n\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00L\\xae#\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 930 }, { "timestamp": "2026-05-28 23:34:30,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000004" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 931 }, { "timestamp": "2026-05-28 23:34:30,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000004" }, { "name": "SubKey", "value": "Software\\Classes" }, { "name": "Handle", "value": "0x0000037c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes" } ], "repeated": 0, "id": 932 }, { "timestamp": "2026-05-28 23:34:30,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" } ], "repeated": 0, "id": 933 }, { "timestamp": "2026-05-28 23:34:30,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\" }, { "name": "NotifyFilter", "value": "0x10000005" }, { "name": "WatchSubtree", "value": "1" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 934 }, { "timestamp": "2026-05-28 23:34:30,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000380" } ], "repeated": 0, "id": 935 }, { "timestamp": "2026-05-28 23:34:30,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xd0\\xcer]D\\x00\\x00\\x00`\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xff\\xff\\xff\\xff\\xf8\\x81h\\x86\\xfb\\x7f\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xc0h\\x86\\xfb\\x7f\\x00\\x00\\xa8\\xcfr]D\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00k\\x02I\\xc5\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 936 }, { "timestamp": "2026-05-28 23:34:30,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" } ], "repeated": 0, "id": 937 }, { "timestamp": "2026-05-28 23:34:30,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE" }, { "name": "Handle", "value": "0x00000380" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE" } ], "repeated": 0, "id": 938 }, { "timestamp": "2026-05-28 23:34:30,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000380" }, { "name": "ValueName", "value": "MaxSxSHashCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount" } ], "repeated": 0, "id": 939 }, { "timestamp": "2026-05-28 23:34:30,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000380" } ], "repeated": 0, "id": 940 }, { "timestamp": "2026-05-28 23:34:30,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x7ffbc5c20000" } ], "repeated": 0, "id": 941 }, { "timestamp": "2026-05-28 23:34:30,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\PROPSYS" }, { "name": "DllBase", "value": "0x7ffbc0db0000" } ], "repeated": 0, "id": 942 }, { "timestamp": "2026-05-28 23:34:30,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\CoreMessaging" }, { "name": "DllBase", "value": "0x7ffbc2820000" } ], "repeated": 0, "id": 943 }, { "timestamp": "2026-05-28 23:34:30,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\execmodelclient" }, { "name": "DllBase", "value": "0x7ffbb5020000" } ], "repeated": 0, "id": 944 }, { "timestamp": "2026-05-28 23:34:30,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\execmodelclient.dll" }, { "name": "BaseAddress", "value": "0x7ffbb5020000" } ], "repeated": 0, "id": 945 }, { "timestamp": "2026-05-28 23:34:30,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbb5020000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\execmodelclient.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 946 }, { "timestamp": "2026-05-28 23:34:30,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "execmodelclient.dll" }, { "name": "ModuleHandle", "value": "0x7ffbb5020000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbb502ac80" } ], "repeated": 0, "id": 947 }, { "timestamp": "2026-05-28 23:34:30,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "execmodelclient.dll" }, { "name": "ModuleHandle", "value": "0x7ffbb5020000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbb502b9b0" } ], "repeated": 0, "id": 948 }, { "timestamp": "2026-05-28 23:34:30,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "execmodelclient.dll" }, { "name": "ModuleHandle", "value": "0x7ffbb5020000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbb502bb00" } ], "repeated": 0, "id": 949 }, { "timestamp": "2026-05-28 23:34:30,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 950 }, { "timestamp": "2026-05-28 23:34:30,733", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbb507f000" }, { "name": "ModuleName", "value": "execmodelclient.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 951 }, { "timestamp": "2026-05-28 23:34:30,733", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbb507f000" }, { "name": "ModuleName", "value": "execmodelclient.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 952 }, { "timestamp": "2026-05-28 23:34:30,733", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 953 }, { "timestamp": "2026-05-28 23:34:30,733", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c4c000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 954 }, { "timestamp": "2026-05-28 23:34:30,733", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00 \\xbb\\xc4\\xe4\\xbc\\x01\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\xc0\\xbb\\xc4\\xe4\\xbc\\x01\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xbb\\xc4\\xe4\\xbc\\x01\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\xf4\\xbc\\xc4\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xbd\\xc4\\xe4\\xbc\\x01\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x10\\xbd\\xc4\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xbd\\xc4\\xe4\\xbc\\x01\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x008\\xbd\\xc4\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xbd\\xc4\\xe4\\xbc\\x01\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\x10\\xbc\\xc4\\xe4\\xbc\\x01\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x96\\xbc\\xc4\\xe4\\xbc\\x01\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\x9c\\xbc\\xc4\\xe4\\xbc\\x01\\x00\\x00" } ], "repeated": 0, "id": 955 }, { "timestamp": "2026-05-28 23:34:30,733", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 956 }, { "timestamp": "2026-05-28 23:34:30,733", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00 \\xbb\\xc4\\xe4\\xbc\\x01\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\xc0\\xbb\\xc4\\xe4\\xbc\\x01\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xbb\\xc4\\xe4\\xbc\\x01\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\xf4\\xbc\\xc4\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xbd\\xc4\\xe4\\xbc\\x01\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x10\\xbd\\xc4\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xbd\\xc4\\xe4\\xbc\\x01\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x008\\xbd\\xc4\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xbd\\xc4\\xe4\\xbc\\x01\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\x10\\xbc\\xc4\\xe4\\xbc\\x01\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x96\\xbc\\xc4\\xe4\\xbc\\x01\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\x9c\\xbc\\xc4\\xe4\\xbc\\x01\\x00\\x00" } ], "repeated": 0, "id": 957 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 958 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000003b4" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "9452" } ], "repeated": 0, "id": 959 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000003b4" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000003b8" } ], "repeated": 0, "id": 960 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 961 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" } ], "repeated": 0, "id": 962 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b4" } ], "repeated": 0, "id": 963 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x8d]D\\x00\\x00\\x00\\xec$\\x00\\x00\\x00\\x00\\x00\\x00\\xf0$\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9456" } ], "repeated": 0, "id": 964 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x000003bc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x7ffbc5c353d0" }, { "name": "Parameter", "value": "0x1bce4d07590" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "9840" }, { "name": "ProcessId", "value": "9452" }, { "name": "Module", "value": "shcore.dll" } ], "repeated": 0, "id": 965 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x000003bc", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffbc5c353d0" }, { "name": "Parameter", "value": "0x1bce4d07590" }, { "name": "CreationFlags", "value": "0x00000004" }, { "name": "ThreadId", "value": "9840" }, { "name": "ProcessId", "value": "9452" } ], "repeated": 0, "id": 966 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x000003bc" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "9840" }, { "name": "ProcessId", "value": "9452" } ], "repeated": 0, "id": 967 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003bc" } ], "repeated": 0, "id": 968 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 969 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9840", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x43880021b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 970 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9840", "caller": "0x7ffbc7bc507d", "parentcaller": "0x7ffbc7bc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 971 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ffbc5c353d0" }, { "name": "Parameter", "value": "0x1bce4d07590" } ], "repeated": 0, "id": 972 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9840", "caller": "0x7ffbc7b97830", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc5cc7000" }, { "name": "ModuleName", "value": "shcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 973 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9840", "caller": "0x7ffbc7b97881", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc5cc7000" }, { "name": "ModuleName", "value": "shcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 974 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9840", "caller": "0x7ffbc548ebae", "parentcaller": "0x7ffbc5c684de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x8f]D\\x00\\x00\\x00\\xec$\\x00\\x00\\x00\\x00\\x00\\x00p&\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9840" } ], "repeated": 0, "id": 975 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" } ], "repeated": 0, "id": 976 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003b8" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000344" }, { "name": "ObjectAttributesName", "value": "Windows.Foundation.Diagnostics.AsyncCausalityTracer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer" } ], "repeated": 0, "id": 977 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003b8" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00f\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00F\\x00o\\x00u\\x00n\\x00d\\x00a\\x00t\\x00i\\x00o\\x00n\\x00.\\x00D\\x00i\\x00a\\x00g\\x00n\\x00o\\x00s\\x00t\\x00i\\x00c\\x00s\\x00.\\x00A\\x00s\\x00y\\x00n\\x00c\\x00C\\x00a\\x00u\\x00s\\x00a\\x00l\\x00i\\x00t\\x00y\\x00T\\x00r\\x00a\\x00c\\x00e\\x00r\\x00\\x00\\x000\\xffc6r]D\\x00\\x00\\x00\\xffb0EM\\xffc7\\xfffb\\x7f\\x00\\x00\\xfff8\\xffcc\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc7r]D\\x00\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xff92\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffc6r]D\\x00\\x00\\x00\\x14\"A\\xffbfP\\xffe2\\x00\\x00\\x03\\x00\\x00\\x00D\\x00\\x00\\x00Pq\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\xfff8\\xffcc\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\xffd0\\xffcc\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d!\\xffc7\\xfffb\\x7f\\x00\\x00\\xff80\\xff92\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffcc\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\xff80\\xff92\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00Pq\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s!\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xffb3\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00Pq\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00P\\xffcc\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00P\\xffcc\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xff92\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffcc\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00\\xff80\\xff92\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00p\\x1d\\xffc3\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc8r]D\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffcb\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\xffd0\\xffcc\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 978 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivationType" } ], "repeated": 0, "id": 979 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Server" } ], "repeated": 0, "id": 980 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\combase.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\DllPath" } ], "repeated": 0, "id": 981 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Threading" } ], "repeated": 0, "id": 982 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\TrustLevel" } ], "repeated": 0, "id": 983 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003b8" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\CustomAttributes" } ], "repeated": 0, "id": 984 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\RemoteServer" } ], "repeated": 0, "id": 985 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateAsUser" } ], "repeated": 0, "id": 986 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInSharedBroker" } ], "repeated": 0, "id": 987 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 988 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Permissions" } ], "repeated": 0, "id": 989 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateOnHostFlags" } ], "repeated": 0, "id": 990 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" } ], "repeated": 0, "id": 991 }, { "timestamp": "2026-05-28 23:34:30,780", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\combase.dll" }, { "name": "BaseAddress", "value": "0x7ffbc71d0000" } ], "repeated": 0, "id": 992 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc71d0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\combase.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 993 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc72858a0" } ], "repeated": 0, "id": 994 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc72af090" } ], "repeated": 0, "id": 995 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 996 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 997 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ole32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc7560000" } ], "repeated": 0, "id": 998 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc7560000", "arguments": [ { "name": "lpLibFileName", "value": "ole32.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 999 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ole32.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7560000" }, { "name": "FunctionName", "value": "CoCreateFreeThreadedMarshaler" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc72487a0" } ], "repeated": 0, "id": 1000 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c0010a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1001 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003b8" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000344" }, { "name": "ObjectAttributesName", "value": "Windows.UI.Notifications.ToastNotificationManager" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager" } ], "repeated": 0, "id": 1002 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003b8" }, { "name": "KeyInformation", "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00b\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00U\\x00I\\x00.\\x00N\\x00o\\x00t\\x00i\\x00f\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00s\\x00.\\x00T\\x00o\\x00a\\x00s\\x00t\\x00N\\x00o\\x00t\\x00i\\x00f\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffd1r]D\\x00\\x00\\x00\\xffb0EM\\xffc7\\xfffb\\x7f\\x00\\x00\\xffd8\\xffce\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffd2r]D\\x00\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff9c\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffd1r]D\\x00\\x00\\x00\\xffb46A\\xffbfP\\xffe2\\x00\\x00\\x03\\x00\\x00\\x00D\\x00\\x00\\x00\\xffd0q\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\xffd8\\xffce\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\xffb0\\xffce\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d!\\xffc7\\xfffb\\x7f\\x00\\x00\\x10\\xff9c\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xffce\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\x10\\xff9c\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\xffd0q\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s!\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffcc\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\xffd0q\\xffc4\\xffe4\\xffbc\\x01\\x00\\x000\\xffce\\xffc4\\xffe4\\xffbc\\x01\\x00\\x000\\xffce\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff9c\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffce\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00\\x10\\xff9c\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x1f\\xffc3\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffd3r]D\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffb4\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00\\xffb0\\xffce\\xffc4\\xffe4\\xffbc\\x01\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 1003 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivationType" } ], "repeated": 0, "id": 1004 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Server" } ], "repeated": 0, "id": 1005 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\wpnapps.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\DllPath" } ], "repeated": 0, "id": 1006 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Threading" } ], "repeated": 0, "id": 1007 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9840", "caller": "0x7ffbc549026b", "parentcaller": "0x7ffbb5059613", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000003c4" } ], "repeated": 0, "id": 1008 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9840", "caller": "0x7ffbb50596fd", "parentcaller": "0x7ffbb505962b", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xf3\\x9f^D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00D\\x00\\x00\\x00\\xe0\\xa3\\xc0\\xe4\\xbc\\x01\\x00\\x00k\\x02I\\xc5\\xfb\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1009 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9840", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbb5059675", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003c4" } ], "repeated": 0, "id": 1010 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\TrustLevel" } ], "repeated": 0, "id": 1011 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003b8" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\CustomAttributes" } ], "repeated": 0, "id": 1012 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\RemoteServer" } ], "repeated": 0, "id": 1013 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateAsUser" } ], "repeated": 0, "id": 1014 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInSharedBroker" } ], "repeated": 0, "id": 1015 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 1016 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Type", "value": "0x4400000003" }, { "name": "DataLength", "value": "316" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Permissions" } ], "repeated": 0, "id": 1017 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Data", "value": "\\x01\\x00\\x14\\x80$\\x01\\x00\\x000\\x01\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00\\xf4\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x13\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x14\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x0b\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\t\\x00L\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x04\\x00\\x00\\x00artx\\xf8.\\x00\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00I\\x00S\\x00M\\x00U\\x00L\\x00T\\x00I\\x00S\\x00E\\x00S\\x00S\\x00I\\x00O\\x00N\\x00S\\x00K\\x00U\\x00\\xa2\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Permissions" } ], "repeated": 0, "id": 1018 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003b8" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateOnHostFlags" } ], "repeated": 0, "id": 1019 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003b8" } ], "repeated": 0, "id": 1020 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9840", "caller": "0x7ffbb504d259", "parentcaller": "0x7ffbb5048bdd", "category": "com", "api": "CoGetClassObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "38142214-ED63-4965-9214-1BBC06E130E9" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8E1BBBB9-B3D5-430D-B276-D0E7454CAAB2" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1021 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\wintypes" }, { "name": "DllBase", "value": "0x7ffbc1080000" } ], "repeated": 0, "id": 1022 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\RMCLIENT" }, { "name": "DllBase", "value": "0x7ffbc2f30000" } ], "repeated": 0, "id": 1023 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\XmlLite" }, { "name": "DllBase", "value": "0x7ffbc0d70000" } ], "repeated": 0, "id": 1024 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\twinapi.appcore" }, { "name": "DllBase", "value": "0x7ffbbf7e0000" } ], "repeated": 0, "id": 1025 }, { "timestamp": "2026-05-28 23:34:30,795", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\wpnapps" }, { "name": "DllBase", "value": "0x7ffbb08e0000" } ], "repeated": 0, "id": 1026 }, { "timestamp": "2026-05-28 23:34:30,858", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\wpnapps.dll" }, { "name": "BaseAddress", "value": "0x7ffbb08e0000" } ], "repeated": 0, "id": 1027 }, { "timestamp": "2026-05-28 23:34:30,858", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbb08e0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\wpnapps.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 1028 }, { "timestamp": "2026-05-28 23:34:30,858", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "ModuleHandle", "value": "0x7ffbb08e0000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbb08f7d00" } ], "repeated": 0, "id": 1029 }, { "timestamp": "2026-05-28 23:34:30,858", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "ModuleHandle", "value": "0x7ffbb08e0000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbb08fb840" } ], "repeated": 0, "id": 1030 }, { "timestamp": "2026-05-28 23:34:30,858", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1031 }, { "timestamp": "2026-05-28 23:34:30,858", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1032 }, { "timestamp": "2026-05-28 23:34:30,858", "thread_id": "9840", "caller": "0x7ffbb502907d", "parentcaller": "0x7ffbb504d2af", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "D648FEA1-EA00-4FF4-B8BD-034BD2B25A23" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "1D868537-EEA2-4C03-BB99-8A58862F7A59" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1033 }, { "timestamp": "2026-05-28 23:34:30,858", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1034 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7b593b0" } ], "repeated": 0, "id": 1035 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7befc40" } ], "repeated": 0, "id": 1036 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7b92460" } ], "repeated": 0, "id": 1037 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bacbd0" } ], "repeated": 0, "id": 1038 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "164" } ], "repeated": 0, "id": 1039 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx" } ], "repeated": 0, "id": 1040 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "AllowDevelopmentWithoutDevLicense" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense" } ], "repeated": 0, "id": 1041 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 1042 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock" } ], "repeated": 0, "id": 1043 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "AllowDevelopmentWithoutDevLicense" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense" } ], "repeated": 0, "id": 1044 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 1045 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" } ], "repeated": 0, "id": 1046 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7b593b0" } ], "repeated": 0, "id": 1047 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7befc40" } ], "repeated": 0, "id": 1048 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7b92460" } ], "repeated": 0, "id": 1049 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bcfa30" } ], "repeated": 0, "id": 1050 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bacbd0" } ], "repeated": 0, "id": 1051 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c52000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1052 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c53000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1053 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE\\AppCompat" }, { "name": "Handle", "value": "0x000003f8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat" } ], "repeated": 0, "id": 1054 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "RaiseActivationAuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel" } ], "repeated": 0, "id": 1055 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" } ], "repeated": 0, "id": 1056 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "AppID\\identity_helper.exe" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\identity_helper.exe" } ], "repeated": 1, "id": 1057 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE\\AppCompat" }, { "name": "Handle", "value": "0x000003f8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat" } ], "repeated": 0, "id": 1058 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "RaiseDefaultAuthnLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel" } ], "repeated": 0, "id": 1059 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" } ], "repeated": 0, "id": 1060 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\OLE" }, { "name": "Handle", "value": "0x000003f8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE" } ], "repeated": 0, "id": 1061 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000003f8" }, { "name": "ValueName", "value": "DefaultAccessPermission" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\DefaultAccessPermission" } ], "repeated": 0, "id": 1062 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000003fc" } ], "repeated": 0, "id": 1063 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1064 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xf0\\xbe\\xc5\\xe4\\xbc\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00" } ], "repeated": 0, "id": 1065 }, { "timestamp": "2026-05-28 23:34:30,874", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" } ], "repeated": 0, "id": 1066 }, { "timestamp": "2026-05-28 23:34:30,889", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\system32\\rpcss.dll" }, { "name": "ModuleHandle", "value": "0x00000000" } ], "repeated": 0, "id": 1067 }, { "timestamp": "2026-05-28 23:34:30,889", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f8" } ], "repeated": 0, "id": 1068 }, { "timestamp": "2026-05-28 23:34:30,889", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1069 }, { "timestamp": "2026-05-28 23:34:30,889", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1070 }, { "timestamp": "2026-05-28 23:34:30,889", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1071 }, { "timestamp": "2026-05-28 23:34:30,889", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003fc" } ], "repeated": 0, "id": 1072 }, { "timestamp": "2026-05-28 23:34:30,889", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1073 }, { "timestamp": "2026-05-28 23:34:30,889", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1074 }, { "timestamp": "2026-05-28 23:34:30,889", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1075 }, { "timestamp": "2026-05-28 23:34:30,889", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x000024ec" }, { "name": "EventName", "value": "MSFT.VSA.COM.DISABLE.9452" } ], "repeated": 0, "id": 1076 }, { "timestamp": "2026-05-28 23:34:30,889", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x00000000" }, { "name": "EventName", "value": "MSFT.VSA.IEC.STATUS.6c736db0" } ], "repeated": 0, "id": 1077 }, { "timestamp": "2026-05-28 23:34:30,889", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c56000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1078 }, { "timestamp": "2026-05-28 23:34:30,889", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{00000134-0000-0000-C000-000000000046}" }, { "name": "Handle", "value": "0x00000412" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 1079 }, { "timestamp": "2026-05-28 23:34:30,889", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000412" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000041a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1080 }, { "timestamp": "2026-05-28 23:34:30,889", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000041a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{00000320-0000-0000-C000-000000000046}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1081 }, { "timestamp": "2026-05-28 23:34:30,889", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000041a" } ], "repeated": 0, "id": 1082 }, { "timestamp": "2026-05-28 23:34:30,889", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000412" } ], "repeated": 0, "id": 1083 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9840", "caller": "0x7ffbc544cc1f", "parentcaller": "0x7ffbc649b8ed", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x0000041c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x7ffbc7272d30" }, { "name": "Parameter", "value": "0x1bce4c62190" }, { "name": "CreateFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "9868" }, { "name": "ProcessId", "value": "9452" }, { "name": "Module", "value": "combase.dll" } ], "repeated": 0, "id": 1084 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9868", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800220000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1085 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c58000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1086 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9868", "caller": "0x7ffbc7bc507d", "parentcaller": "0x7ffbc7bc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1087 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9868", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ffbc7272d30" }, { "name": "Parameter", "value": "0x1bce4c62190" } ], "repeated": 0, "id": 1088 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1089 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000003f4" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 1090 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000418" } ], "repeated": 0, "id": 1091 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xaby\t\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00jy\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1092 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "h\\xe4\\xc5\\xe4\\xbc\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1093 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00\\x19\\xc6\\xe4\\xbc\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1094 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1095 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x98\\xbe\\xc2\\xe4\\xbc\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1096 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1097 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x98\\x18\\xc6\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 1098 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00j}Xv\r\\x8a\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00`\\xc7r]D\\x00\\x00\\x00X\\xc7r]D\\x00\\x00\\x00(\\xc7r]D\\x00\\x00\\x00H\\xc7r]" } ], "repeated": 0, "id": 1099 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x18\\xc6\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xc5r]D\\x00\\x00\\x00\\x18\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 1100 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xaby\t\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00jy\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1101 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "H\\xe6\\xc5\\xe4\\xbc\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1102 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xe0\\x14\\xc6\\xe4\\xbc\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1103 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1104 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c74000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1105 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xe8@\\xc7\\xe4\\xbc\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1106 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1107 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "8\\x15\\xc6\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 1108 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00\\xcaxXv\r\\x8a\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00\\xc0\\xc3r]D\\x00\\x00\\x00\\xb8\\xc3r]D\\x00\\x00\\x00\\x88\\xc3r]D\\x00\\x00\\x00\\xa8\\xc3r]" } ], "repeated": 0, "id": 1109 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x15\\xc6\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xa8\\xc1r]D\\x00\\x00\\x00\\x18\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 1110 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 1111 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000418" } ], "repeated": 0, "id": 1112 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1113 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000418" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 1114 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000041c" } ], "repeated": 0, "id": 1115 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xaby\t\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00jy\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1116 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "x\\xe8\\xc5\\xe4\\xbc\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1117 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xa0\\x18\\xc6\\xe4\\xbc\\x01\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1118 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1119 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x08E\\xc7\\xe4\\xbc\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1120 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1121 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x98\\x1b\\xc6\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 1122 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00j}Xv\r\\x8a\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00`\\xc7r]D\\x00\\x00\\x00X\\xc7r]D\\x00\\x00\\x00(\\xc7r]D\\x00\\x00\\x00H\\xc7r]" } ], "repeated": 0, "id": 1123 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x1b\\xc6\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xc5r]D\\x00\\x00\\x00\\x1c\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 1124 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xaby\t\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00jy\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1125 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x18\\xe4\\xc5\\xe4\\xbc\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1126 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x80\\x14\\xc6\\xe4\\xbc\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1127 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1128 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xc8E\\xc7\\xe4\\xbc\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1129 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1130 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd8\\x14\\xc6\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 1131 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00\\xcaxXv\r\\x8a\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00\\xc0\\xc3r]D\\x00\\x00\\x00\\xb8\\xc3r]D\\x00\\x00\\x00\\x88\\xc3r]D\\x00\\x00\\x00\\xa8\\xc3r]" } ], "repeated": 0, "id": 1132 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x14\\xc6\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xa8\\xc1r]D\\x00\\x00\\x00\\x1c\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 1133 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000418" } ], "repeated": 0, "id": 1134 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000041c" } ], "repeated": 0, "id": 1135 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1136 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x0000041c" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 1137 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000418" } ], "repeated": 0, "id": 1138 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xaby\t\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00jy\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1139 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x08\\xea\\xc5\\xe4\\xbc\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1140 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xc0\\x16\\xc6\\xe4\\xbc\\x01\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1141 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1142 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "X@\\xc7\\xe4\\xbc\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1143 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1144 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x18\\x17\\xc6\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 1145 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00j}Xv\r\\x8a\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00`\\xc7r]D\\x00\\x00\\x00X\\xc7r]D\\x00\\x00\\x00(\\xc7r]D\\x00\\x00\\x00H\\xc7r]" } ], "repeated": 0, "id": 1146 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x17\\xc6\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xc5r]D\\x00\\x00\\x00\\x18\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 1147 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xaby\t\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00jy\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1148 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "x\\xe3\\xc5\\xe4\\xbc\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1149 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x80\\x17\\xc6\\xe4\\xbc\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1150 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1151 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "8E\\xc7\\xe4\\xbc\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1152 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1153 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x98\\x1b\\xc6\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 1154 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00\\xcaxXv\r\\x8a\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00\\xc0\\xc3r]D\\x00\\x00\\x00\\xb8\\xc3r]D\\x00\\x00\\x00\\x88\\xc3r]D\\x00\\x00\\x00\\xa8\\xc3r]" } ], "repeated": 0, "id": 1155 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x1b\\xc6\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xa8\\xc1r]D\\x00\\x00\\x00\\x18\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 1156 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000041c" } ], "repeated": 0, "id": 1157 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000418" } ], "repeated": 0, "id": 1158 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1159 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000418" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 1160 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000041c" } ], "repeated": 0, "id": 1161 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xaby\t\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00jy\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1162 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "8\\xe7\\xc5\\xe4\\xbc\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00w\\x00s\\x00\\\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00w\\x00p\\x00n\\x00a\\x00p\\x00p\\x00s\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00l\\x00y\\x00" } ], "repeated": 0, "id": 1163 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xe0\\x14\\xc6\\xe4\\xbc\\x01\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1164 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1165 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "HD\\xc7\\xe4\\xbc\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1166 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1167 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "x\\x14\\xc6\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 1168 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00j}Xv\r\\x8a\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00`\\xc7r]D\\x00\\x00\\x00X\\xc7r]D\\x00\\x00\\x00(\\xc7r]D\\x00\\x00\\x00H\\xc7r]" } ], "repeated": 0, "id": 1169 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x14\\xc6\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xc5r]D\\x00\\x00\\x00\\x1c\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 1170 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xaby\t\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00jy\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1171 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x98\\xe6\\xc5\\xe4\\xbc\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00e\\x00r\\x00s\\x00o\\x00n\\x00a\\x00t\\x00i\\x00o\\x00n\\x00 \\x00D\\x00y\\x00n\\x00a\\x00m\\x00i\\x00c\\x00 \\x00F\\x00a\\x00l\\x00s\\x00e\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1172 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xa0\\x18\\xc6\\xe4\\xbc\\x01\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1173 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1174 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x08E\\xc7\\xe4\\xbc\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1175 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1176 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "x\\x1a\\xc6\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 1177 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00\\xcaxXv\r\\x8a\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00\\xc0\\xc3r]D\\x00\\x00\\x00\\xb8\\xc3r]D\\x00\\x00\\x00\\x88\\xc3r]D\\x00\\x00\\x00\\xa8\\xc3r]" } ], "repeated": 0, "id": 1178 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x1a\\xc6\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xa8\\xc1r]D\\x00\\x00\\x00\\x1c\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 1179 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000418" } ], "repeated": 0, "id": 1180 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000041c" } ], "repeated": 0, "id": 1181 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1182 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c59000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1183 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c64000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1184 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9872", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c75000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1185 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9872", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c65000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1186 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9872", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c76000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1187 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9872", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c66000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1188 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9872", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4d08000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1189 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9872", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800222000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1190 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9872", "caller": "0x7ffbc7bc507d", "parentcaller": "0x7ffbc7bc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1191 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9872", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ffbc7ba2b30" }, { "name": "Parameter", "value": "0x1bce4c02340" } ], "repeated": 0, "id": 1192 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9872", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc703ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000041c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1193 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9872", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c67000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1194 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9876", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c77000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1195 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9876", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c78000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1196 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9876", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c79000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1197 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9876", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c7a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1198 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9876", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c7c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1199 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9840", "caller": "0x7ffbc7051630", "parentcaller": "0x7ffbc70512cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1200 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9876", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c80000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1201 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9872", "caller": "0x7ffbc7b93f7a", "parentcaller": "0x7ffbc7020ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1202 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9872", "caller": "0x7ffbc549026b", "parentcaller": "0x7ffbc7020daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000438" } ], "repeated": 0, "id": 1203 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9872", "caller": "0x7ffbc7b88cde", "parentcaller": "0x7ffbc7bc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xaby\t\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00jy\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1204 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9872", "caller": "0x7ffbc7bb6e46", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "x\\xe3\\xc5\\xe4\\xbc\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1205 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9872", "caller": "0x7ffbc7bb6e9b", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00\\x19\\xc6\\xe4\\xbc\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1206 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9872", "caller": "0x7ffbc7bb6f0e", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x18A\\xc7\\xe4\\xbc\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1207 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9872", "caller": "0x7ffbc7bb6f37", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1208 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9872", "caller": "0x7ffbc7bb6f8f", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "x\\x14\\xc6\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 1209 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9876", "caller": "0x7ffb84f3bafb", "parentcaller": "0x7ffb84f3b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x242000104000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1210 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9872", "caller": "0x7ffbc7bb6e46", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xf8\\xe0\\xc5\\xe4\\xbc\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1211 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9872", "caller": "0x7ffbc7bb6e9b", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x80\\x1a\\xc6\\xe4\\xbc\\x01\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1212 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9872", "caller": "0x7ffbc7bb6ec0", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1213 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9872", "caller": "0x7ffbc7bb6f0e", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xa8A\\xc7\\xe4\\xbc\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1214 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9872", "caller": "0x7ffbc7bb6f37", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1215 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9872", "caller": "0x7ffbc7bb6f8f", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "8\\x15\\xc6\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 1216 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9872", "caller": "0x7ffbc7bb7048", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00\\x1a\\x18\\x95u\r\\x8a\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00\\x10\\xe4\\xbf^D\\x00\\x00\\x00\\x08\\xe4\\xbf^D\\x00\\x00\\x00\\xd8\\xe3\\xbf^D\\x00\\x00\\x00\\xf8\\xe3\\xbf^" } ], "repeated": 0, "id": 1217 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9872", "caller": "0x7ffbc7bb707b", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x15\\xc6\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xe1\\xbf^D\\x00\\x00\\x008\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 1218 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9872", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7020e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" } ], "repeated": 0, "id": 1219 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9876", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800223000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1220 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9876", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c0005b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1221 }, { "timestamp": "2026-05-28 23:34:30,905", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" } ], "repeated": 0, "id": 1222 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1223 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9876", "caller": "0x7ffbc7bc507d", "parentcaller": "0x7ffbc7bc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1224 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9876", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ffbc7ba2b30" }, { "name": "Parameter", "value": "0x1bce4c02340" } ], "repeated": 0, "id": 1225 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1226 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" } ], "repeated": 0, "id": 1227 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc72a41cf", "parentcaller": "0x7ffbc7b938c0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000032A-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000149-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1228 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc728224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1229 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000444" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x7ffbc7272d30" }, { "name": "Parameter", "value": "0x1bce4c625d0" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "9880" }, { "name": "ProcessId", "value": "9452" }, { "name": "Module", "value": "combase.dll" } ], "repeated": 0, "id": 1230 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000444", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffbc7272d30" }, { "name": "Parameter", "value": "0x1bce4c625d0" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "9880" }, { "name": "ProcessId", "value": "9452" } ], "repeated": 0, "id": 1231 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c7e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1232 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000444" } ], "repeated": 0, "id": 1233 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9456", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1234 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c83000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1235 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4d14000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1236 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800225000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1237 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c0006b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1238 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bc507d", "parentcaller": "0x7ffbc7bc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1239 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ffbc7272d30" }, { "name": "Parameter", "value": "0x1bce4c625d0" } ], "repeated": 0, "id": 1240 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc703ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000454" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1241 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc72022bf", "parentcaller": "0x7ffbc727fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{E1CDD77A-65D3-4DB0-B339-21F6A48CC2FF}" }, { "name": "Handle", "value": "0x0000044a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{E1CDD77A-65D3-4DB0-B339-21F6A48CC2FF}" } ], "repeated": 0, "id": 1242 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc727fa51", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000044a" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000045e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E1CDD77A-65D3-4db0-B339-21F6A48CC2FF}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1243 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\OneCoreCommonProxyStub" }, { "name": "DllBase", "value": "0x7ffbb6e10000" } ], "repeated": 0, "id": 1244 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc727fa8c", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{00000320-0000-0000-C000-000000000046}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E1CDD77A-65D3-4db0-B339-21F6A48CC2FF}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1245 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc727fad3", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045e" } ], "repeated": 0, "id": 1246 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc727fae4", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000044a" } ], "repeated": 0, "id": 1247 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7272ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 1248 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc71fcd6e", "parentcaller": "0x7ffbc7272ed4", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1249 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7b97830", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbb0a1a000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1250 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7b97881", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbb0a1a000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1251 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc72022bf", "parentcaller": "0x7ffbc727fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{00000035-0000-0000-C000-000000000046}" }, { "name": "Handle", "value": "0x0000044a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{00000035-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 1252 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc727fa51", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000044a" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000045e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000035-0000-0000-C000-000000000046}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1253 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc727fa8c", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{00000320-0000-0000-C000-000000000046}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000035-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1254 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc727fad3", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045e" } ], "repeated": 0, "id": 1255 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc727fae4", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000044a" } ], "repeated": 0, "id": 1256 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc72022bf", "parentcaller": "0x7ffbc727fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}" }, { "name": "Handle", "value": "0x0000044a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}" } ], "repeated": 0, "id": 1257 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbbf83c45c", "parentcaller": "0x7ffbb50290c9", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "6B3B8D23-FA8D-40B9-8DBD-B950333E2C52" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "6D5140C1-7436-11CE-8034-00AA006009FA" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1258 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c87000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1259 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c88000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1260 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc727fa51", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000044a" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000045e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1261 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc7017be3", "parentcaller": "0x7ffbc70515ab", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1262 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc727fa8c", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{00000320-0000-0000-C000-000000000046}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1263 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc7b93f7a", "parentcaller": "0x7ffbc7020ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1264 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc727fad3", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045e" } ], "repeated": 0, "id": 1265 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc727fae4", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000044a" } ], "repeated": 0, "id": 1266 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7b93f7a", "parentcaller": "0x7ffbc7020ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1267 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7020cd1", "parentcaller": "0x7ffbc701f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000448" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 1268 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc549026b", "parentcaller": "0x7ffbc7020daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000045c" } ], "repeated": 0, "id": 1269 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7b88cde", "parentcaller": "0x7ffbc7bc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xaby\t\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00jy\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1270 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6e9b", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xa0\\x18\\xc6\\xe4\\xbc\\x01\\x00\\x00`\\x00\\x00\\x00\\x00`\t\\xfa\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x000\\x00D\\x00\\xd0\\x1a\\xc6\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1271 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1272 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6f0e", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xd8A\\xc7\\xe4\\xbc\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1273 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6f37", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1274 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6f8f", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xb8\\x10\\xc6\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 1275 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc72022bf", "parentcaller": "0x7ffbc727fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{428D4DDD-3462-43DF-9395-1EFF13AE7A4B}" }, { "name": "Handle", "value": "0x0000045a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{428D4DDD-3462-43DF-9395-1EFF13AE7A4B}" } ], "repeated": 0, "id": 1276 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6e46", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x98\\xe1\\xc5\\xe4\\xbc\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00T\\x00r\\x00e\\x00a\\x00t\\x00A\\x00s\\x00C\\x00l\\x00a\\x00s\\x00s\\x00I\\x00n\\x00d\\x00e\\x00x\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1277 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6e9b", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\x1c\\xc6\\xe4\\xbc\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1278 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6ec0", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1279 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6f0e", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xb8@\\xc7\\xe4\\xbc\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1280 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6f37", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1281 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6f8f", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xb8\\x1c\\xc6\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 1282 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb7048", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00J\\x06\\xf5u\r\\x8a\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00@\\xce\\xdf^D\\x00\\x00\\x008\\xce\\xdf^D\\x00\\x00\\x00\\x08\\xce\\xdf^D\\x00\\x00\\x00(\\xce\\xdf^" } ], "repeated": 0, "id": 1283 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc727fa51", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000045a" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000462" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{428D4DDD-3462-43DF-9395-1EFF13AE7A4B}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1284 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7b93f7a", "parentcaller": "0x7ffbc7020ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1285 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x0000045c" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 1286 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc549026b", "parentcaller": "0x7ffbc7020daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000448" } ], "repeated": 0, "id": 1287 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7b88cde", "parentcaller": "0x7ffbc7bc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xaby\t\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00jy\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1288 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6e46", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x98\\xe1\\xc5\\xe4\\xbc\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00T\\x00r\\x00e\\x00a\\x00t\\x00A\\x00s\\x00C\\x00l\\x00a\\x00s\\x00s\\x00I\\x00n\\x00d\\x00e\\x00x\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1289 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6e9b", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xc0\\x10\\xc6\\xe4\\xbc\\x01\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1290 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6ec0", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1291 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc7207b74", "parentcaller": "0x7ffbc72053d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000376" }, { "name": "SubKey", "value": "CLSID\\{B03C2205-F02E-4D77-80DF-E1747AFDD39C}" }, { "name": "Handle", "value": "0x0000045a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{B03C2205-F02E-4D77-80DF-E1747AFDD39C}" } ], "repeated": 0, "id": 1292 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7b88cde", "parentcaller": "0x7ffbc7b8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xaby\t\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00jy\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1293 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000045a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1294 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6e46", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "8\\xe7\\xc5\\xe4\\xbc\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00w\\x00s\\x00\\\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00w\\x00p\\x00n\\x00a\\x00p\\x00p\\x00s\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00l\\x00y\\x00" } ], "repeated": 0, "id": 1295 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000045a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1296 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6e9b", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xc0\\x1c\\xc6\\xe4\\xbc\\x01\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1297 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6ec0", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1298 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6f0e", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xf8B\\xc7\\xe4\\xbc\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1299 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000045a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1300 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6f37", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1301 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc72922e1", "parentcaller": "0x7ffbc7207c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000045a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1302 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6f8f", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x98\\x1e\\xc6\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 1303 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb7048", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00J\\x06\\xf5u\r\\x8a\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00@\\xce\\xdf^D\\x00\\x00\\x008\\xce\\xdf^D\\x00\\x00\\x00\\x08\\xce\\xdf^D\\x00\\x00\\x00(\\xce\\xdf^" } ], "repeated": 0, "id": 1304 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb707b", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x1e\\xc6\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00(\\xcc\\xdf^D\\x00\\x00\\x00H\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 1305 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72081f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000045a" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 1306 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\(Default)" } ], "repeated": 0, "id": 1307 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c89000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1308 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc54509b4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000045a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1309 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc54509f7", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000045a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1310 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xc8\\x9f^D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00Z\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x000\\xc9\\x9f^D\\x00\\x00\\x00" } ], "repeated": 0, "id": 1311 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c86000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1312 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c8b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1313 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7272ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 1314 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1315 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7272ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 1316 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc71fcd6e", "parentcaller": "0x7ffbc7272ed4", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1317 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003a6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1318 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003a6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 1319 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000003a6" }, { "name": "ObjectAttributesName", "value": "Interface\\{50AC103F-D235-4598-BBEF-98FE4D1A3AD4}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{50AC103F-D235-4598-BBEF-98FE4D1A3AD4}" } ], "repeated": 0, "id": 1320 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000462" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\InprocServer32" } ], "repeated": 0, "id": 1321 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000462" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 1322 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc727fa8c", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{50ac103f-d235-4598-bbef-98fe4d1a3ad4}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1323 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc727fad3", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045e" } ], "repeated": 0, "id": 1324 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc5474aa9", "parentcaller": "0x7ffbc54531c6", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000462" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "%systemroot%\\system32\\execmodelproxy.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 1325 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc727fae4", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000044a" } ], "repeated": 0, "id": 1326 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72087bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000462" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "%systemroot%\\system32\\execmodelproxy.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 1327 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7207b74", "parentcaller": "0x7ffbc72053d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000376" }, { "name": "SubKey", "value": "CLSID\\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}" }, { "name": "Handle", "value": "0x0000044a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}" } ], "repeated": 0, "id": 1328 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1329 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1330 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xcd\\xdf^D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00J\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00\\x80\\xce\\xdf^D\\x00\\x00\\x00" } ], "repeated": 0, "id": 1331 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7208d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000462" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\ThreadingModel" } ], "repeated": 0, "id": 1332 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\TreatAs" } ], "repeated": 0, "id": 1333 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc720855f", "parentcaller": "0x7ffbc720829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000462" } ], "repeated": 0, "id": 1334 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1335 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000045a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1336 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000044a" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\TreatAs" } ], "repeated": 0, "id": 1337 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xc8\\x9f^D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00Z\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00 \\xc9\\x9f^D\\x00\\x00\\x00" } ], "repeated": 0, "id": 1338 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc72922e1", "parentcaller": "0x7ffbc7207c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1339 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler32" } ], "repeated": 0, "id": 1340 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000045a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1341 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72081f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000044a" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 1342 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler" } ], "repeated": 0, "id": 1343 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000045a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1344 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000044a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\(Default)" } ], "repeated": 0, "id": 1345 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1346 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1347 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72087bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000044a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Windows Push Notification Developer Proxy Stub" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\(Default)" } ], "repeated": 0, "id": 1348 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc7207b74", "parentcaller": "0x7ffbc72053d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000376" }, { "name": "SubKey", "value": "CLSID\\{B03C2205-F02E-4D77-80DF-E1747AFDD39C}" }, { "name": "Handle", "value": "0x0000045a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{B03C2205-F02E-4D77-80DF-E1747AFDD39C}" } ], "repeated": 0, "id": 1349 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000045a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1350 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000045a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1351 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7208485", "parentcaller": "0x7ffbc720829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000044a" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x0000045e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocServer32" } ], "repeated": 0, "id": 1352 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000045a" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\TreatAs" } ], "repeated": 0, "id": 1353 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000045e" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 1354 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72081f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000045a" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 1355 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\(Default)" } ], "repeated": 0, "id": 1356 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72087bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "%SystemRoot%\\System32\\wpnapps.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 1357 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72087bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "ExecModelProxy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\(Default)" } ], "repeated": 0, "id": 1358 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7208d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045e" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 1359 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc720855f", "parentcaller": "0x7ffbc720829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045e" } ], "repeated": 0, "id": 1360 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc7208485", "parentcaller": "0x7ffbc720829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000045a" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00000462" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32" } ], "repeated": 0, "id": 1361 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler32" } ], "repeated": 0, "id": 1362 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1363 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000044a" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler32" } ], "repeated": 0, "id": 1364 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1365 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000462" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 1366 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000044a" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler" } ], "repeated": 0, "id": 1367 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7208010", "parentcaller": "0x7ffbc72053d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000044a" } ], "repeated": 0, "id": 1368 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1369 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1370 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc5474aa9", "parentcaller": "0x7ffbc54531c6", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000462" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "%systemroot%\\system32\\execmodelproxy.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 1371 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7207b74", "parentcaller": "0x7ffbc72053d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000376" }, { "name": "SubKey", "value": "CLSID\\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}" }, { "name": "Handle", "value": "0x0000044a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}" } ], "repeated": 0, "id": 1372 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72087bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000462" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "%systemroot%\\system32\\execmodelproxy.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 1373 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1374 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1375 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xca\\xdf^D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00J\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00@\\xcb\\xdf^D\\x00\\x00\\x00" } ], "repeated": 0, "id": 1376 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\TreatAs" } ], "repeated": 0, "id": 1377 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1378 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7208d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000462" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\ThreadingModel" } ], "repeated": 0, "id": 1379 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000044a" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\TreatAs" } ], "repeated": 0, "id": 1380 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000045a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1381 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc72922e1", "parentcaller": "0x7ffbc7207c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1382 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000045a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1383 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xc4\\x9f^D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00Z\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00\\xe0\\xc5\\x9f^D\\x00\\x00\\x00" } ], "repeated": 0, "id": 1384 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72081f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000044a" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 1385 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000045a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1386 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000045a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1387 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000044a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\(Default)" } ], "repeated": 0, "id": 1388 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000045a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1389 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc720ab08", "parentcaller": "0x7ffbc720a7d9", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000045a" }, { "name": "SubKey", "value": "LocalServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\LocalServer32" } ], "repeated": 0, "id": 1390 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc54509b4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000045a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1391 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc54509f7", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000045a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1392 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xc4\\x9f^D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00Z\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00P\\xc5\\x9f^D\\x00\\x00\\x00" } ], "repeated": 0, "id": 1393 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc54509f7", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}" } ], "repeated": 0, "id": 1394 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7208485", "parentcaller": "0x7ffbc720829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000044a" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x0000045e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocServer32" } ], "repeated": 0, "id": 1395 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xc4\\x9f^D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00Z\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00 \\xc5\\x9f^D\\x00\\x00\\x00" } ], "repeated": 0, "id": 1396 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\LocalServer" } ], "repeated": 0, "id": 1397 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000045e" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 1398 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045e" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 1399 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc720ad4d", "parentcaller": "0x7ffbc72083b8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000462" }, { "name": "SubKey", "value": "Elevation" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\Elevation" } ], "repeated": 0, "id": 1400 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc720adb1", "parentcaller": "0x7ffbc72083b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000462" } ], "repeated": 0, "id": 1401 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5474aa9", "parentcaller": "0x7ffbc54531c6", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "%SystemRoot%\\System32\\wpnapps.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 1402 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc7208010", "parentcaller": "0x7ffbc72053d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045a" } ], "repeated": 0, "id": 1403 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003a6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1404 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003a6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 1405 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000003a6" }, { "name": "ObjectAttributesName", "value": "CLSID\\{B03C2205-F02E-4D77-80DF-E1747AFDD39C}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{B03C2205-F02E-4D77-80DF-E1747AFDD39C}" } ], "repeated": 0, "id": 1406 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{B03C2205-F02E-4D77-80DF-E1747AFDD39C}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{B03C2205-F02E-4D77-80DF-E1747AFDD39C}" } ], "repeated": 0, "id": 1407 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc727f8f8", "parentcaller": "0x7ffbc720213b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000045a" }, { "name": "SubKey", "value": "TreatAs" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\TreatAs" } ], "repeated": 0, "id": 1408 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1409 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1410 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1411 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1412 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xc8\\xdf^D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00J\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00\\xd0\\xc9\\xdf^D\\x00\\x00\\x00" } ], "repeated": 0, "id": 1413 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler32" } ], "repeated": 0, "id": 1414 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1415 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000044a" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler32" } ], "repeated": 0, "id": 1416 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1417 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1418 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xc8\\xdf^D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00J\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00\\xd0\\xc9\\xdf^D\\x00\\x00\\x00" } ], "repeated": 0, "id": 1419 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler" } ], "repeated": 0, "id": 1420 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1421 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1422 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1423 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xc8\\xdf^D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00J\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00p\\xc9\\xdf^D\\x00\\x00\\x00" } ], "repeated": 0, "id": 1424 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\LocalServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\LocalServer32" } ], "repeated": 0, "id": 1425 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\execmodelproxy" }, { "name": "DllBase", "value": "0x7ffbb3400000" } ], "repeated": 0, "id": 1426 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1427 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000044a" }, { "name": "ObjectAttributesName", "value": "LocalServer32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\LocalServer32" } ], "repeated": 0, "id": 1428 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720a825", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000044a" }, { "name": "ValueName", "value": "AppID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\AppID" } ], "repeated": 0, "id": 1429 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1430 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1431 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xc8\\xdf^D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00J\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00\\x10\\xc9\\xdf^D\\x00\\x00\\x00" } ], "repeated": 0, "id": 1432 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\LocalServer" } ], "repeated": 0, "id": 1433 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1434 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000044a" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\LocalServer" } ], "repeated": 0, "id": 1435 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc720ad16", "parentcaller": "0x7ffbc72083b8", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000376" }, { "name": "SubKey", "value": "CLSID\\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}" }, { "name": "Handle", "value": "0x0000045e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}" } ], "repeated": 0, "id": 1436 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc720ad4d", "parentcaller": "0x7ffbc72083b8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000045e" }, { "name": "SubKey", "value": "Elevation" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\Elevation" } ], "repeated": 0, "id": 1437 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc720adb1", "parentcaller": "0x7ffbc72083b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045e" } ], "repeated": 0, "id": 1438 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7208010", "parentcaller": "0x7ffbc72053d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000044a" } ], "repeated": 0, "id": 1439 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc72022bf", "parentcaller": "0x7ffbc72025e9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "CLSID\\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}" }, { "name": "Handle", "value": "0x0000044a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}" } ], "repeated": 0, "id": 1440 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc727f8f8", "parentcaller": "0x7ffbc720213b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000044a" }, { "name": "SubKey", "value": "TreatAs" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\TreatAs" } ], "repeated": 0, "id": 1441 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7202160", "parentcaller": "0x7ffbc71f9277", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000044a" } ], "repeated": 0, "id": 1442 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1443 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1444 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c71000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1445 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7b93f7a", "parentcaller": "0x7ffbc7020ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1446 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7020cd1", "parentcaller": "0x7ffbc701f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000448" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 1447 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc549026b", "parentcaller": "0x7ffbc7020daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000045c" } ], "repeated": 0, "id": 1448 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7b88cde", "parentcaller": "0x7ffbc7bc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xaby\t\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00jy\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1449 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6e46", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x08\\xe5\\xc5\\xe4\\xbc\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1450 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6e9b", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xe0\\xe7\\xc8\\xe4\\xbc\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1451 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6ec0", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1452 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6f0e", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xb8@\\xc7\\xe4\\xbc\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1453 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6f37", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1454 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6f8f", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x18\\xea\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 1455 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb7048", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00\\xda\\x10\\xf5u\r\\x8a\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00\\xd0\\xdb\\xdf^D\\x00\\x00\\x00\\xc8\\xdb\\xdf^D\\x00\\x00\\x00\\x98\\xdb\\xdf^D\\x00\\x00\\x00\\xb8\\xdb\\xdf^" } ], "repeated": 0, "id": 1456 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc54508ee", "parentcaller": "0x7ffbb5036dcd", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000460" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "9452" } ], "repeated": 0, "id": 1457 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb707b", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xea\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xb8\\xd9\\xdf^D\\x00\\x00\\x00\\\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 1458 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7b88cde", "parentcaller": "0x7ffbc7b8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xaby\t\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00jy\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1459 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c8f000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1460 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6e46", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x98\\xeb\\xc5\\xe4\\xbc\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1461 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbb5036eeb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000460" } ], "repeated": 0, "id": 1462 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6e9b", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": " \\xe1\\xc8\\xe4\\xbc\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1463 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc54508ee", "parentcaller": "0x7ffbb5029876", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000460" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "9452" } ], "repeated": 0, "id": 1464 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6ec0", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1465 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc549026b", "parentcaller": "0x7ffbb50298bc", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000460" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000458" } ], "repeated": 0, "id": 1466 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6f0e", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xc8E\\xc7\\xe4\\xbc\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1467 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc54554eb", "parentcaller": "0x7ffbb5029910", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xf2\\x9f^D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1468 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6f37", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1469 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "x\\xe1\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 1470 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbb5029af9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000460" } ], "repeated": 0, "id": 1471 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000460" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "9452" } ], "repeated": 0, "id": 1472 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00:\\x0c\\xf5u\r\\x8a\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x000\\xd8\\xdf^D\\x00\\x00\\x00(\\xd8\\xdf^D\\x00\\x00\\x00\\xf8\\xd7\\xdf^D\\x00\\x00\\x00\\x18\\xd8\\xdf^" } ], "repeated": 0, "id": 1473 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc549026b", "parentcaller": "0x7ffbc545cbb0", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000460" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000458" } ], "repeated": 0, "id": 1474 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb707b", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe1\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x18\\xd6\\xdf^D\\x00\\x00\\x00\\\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 1475 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc545aa1f", "parentcaller": "0x7ffbc545cb7c", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1476 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7020e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 1477 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c90000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1478 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7020e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045c" } ], "repeated": 0, "id": 1479 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc545aaa8", "parentcaller": "0x7ffbc545cb7c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00P\\xf0\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\xf0\\xf0\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf1\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00$\\xf2\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\xf2\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00@\\xf2\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xf2\\xc8\\xe4\\xbc\\x01\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00h\\xf2\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\xf2\\xc8\\xe4\\xbc\\x01\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00@\\xf1\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\xc6\\xf1\\xc8\\xe4\\xbc\\x01\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\xcc\\xf1\\xc8\\xe4\\xbc\\x01\\x00\\x00" } ], "repeated": 0, "id": 1480 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc545cbbe", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000458" } ], "repeated": 0, "id": 1481 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbb50297e7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000460" } ], "repeated": 0, "id": 1482 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1483 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7272ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045c" } ], "repeated": 0, "id": 1484 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc71fcd6e", "parentcaller": "0x7ffbc7272ed4", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1485 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003a6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1486 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003a6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 1487 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000003a6" }, { "name": "ObjectAttributesName", "value": "Interface\\{7AB93C52-0E48-4750-BA9D-1A4113981847}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7AB93C52-0E48-4750-BA9D-1A4113981847}" } ], "repeated": 0, "id": 1488 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc727fa51", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000045e" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000044a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7ab93c52-0e48-4750-ba9d-1a4113981847}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1489 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000044a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7ab93c52-0e48-4750-ba9d-1a4113981847}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1490 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc727fad3", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000044a" } ], "repeated": 0, "id": 1491 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc727fae4", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045e" } ], "repeated": 0, "id": 1492 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1493 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1494 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7b93f7a", "parentcaller": "0x7ffbc7020ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1495 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7020cd1", "parentcaller": "0x7ffbc701f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x0000045c" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 1496 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc549026b", "parentcaller": "0x7ffbc7020daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000448" } ], "repeated": 0, "id": 1497 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7b88cde", "parentcaller": "0x7ffbc7bc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xaby\t\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00jy\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1498 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6e46", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xf8\\xea\\xc5\\xe4\\xbc\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1499 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6e9b", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xa0\\xeb\\xc8\\xe4\\xbc\\x01\\x00\\x00`\\x00\\x00\\x002\\x001\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x008\\x006\\x000\\x004\\x000\\x00-\\x003\\x002\\x001\\x000\\x002\\x007\\x009\\x004\\x006\\x003\\x00-\\x008\\x004\\x007\\x009\\x007\\x007\\x006\\x000\\x008\\x00-\\x001\\x00" } ], "repeated": 0, "id": 1500 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6ec0", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1501 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6f0e", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xb8@\\xc7\\xe4\\xbc\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1502 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6f37", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1503 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6f8f", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "x\\xe7\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 1504 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb7048", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00\\xda\\x10\\xf5u\r\\x8a\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00\\xd0\\xdb\\xdf^D\\x00\\x00\\x00\\xc8\\xdb\\xdf^D\\x00\\x00\\x00\\x98\\xdb\\xdf^D\\x00\\x00\\x00\\xb8\\xdb\\xdf^" } ], "repeated": 0, "id": 1505 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb707b", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe7\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xb8\\xd9\\xdf^D\\x00\\x00\\x00H\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 1506 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7b88cde", "parentcaller": "0x7ffbc7b8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xaby\t\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00jy\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1507 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6e46", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xd8\\xec\\xc5\\xe4\\xbc\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1508 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6e9b", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00\\xe3\\xc8\\xe4\\xbc\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1509 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1510 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6f0e", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "HA\\xc7\\xe4\\xbc\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1511 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6f37", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1512 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb6f8f", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xf8\\xe8\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 1513 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00:\\x0c\\xf5u\r\\x8a\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x000\\xd8\\xdf^D\\x00\\x00\\x00(\\xd8\\xdf^D\\x00\\x00\\x00\\xf8\\xd7\\xdf^D\\x00\\x00\\x00\\x18\\xd8\\xdf^" } ], "repeated": 0, "id": 1514 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7bb707b", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xe8\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x18\\xd6\\xdf^D\\x00\\x00\\x00H\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 1515 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7020e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045c" } ], "repeated": 0, "id": 1516 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7020e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 1, "id": 1517 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc71fcd6e", "parentcaller": "0x7ffbc7272ed4", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1518 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc72022bf", "parentcaller": "0x7ffbc727fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{5CADDC63-01D3-4C97-986F-0533483FEE14}" }, { "name": "Handle", "value": "0x0000044a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5CADDC63-01D3-4C97-986F-0533483FEE14}" } ], "repeated": 0, "id": 1519 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc727fa51", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000044a" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000045e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5caddc63-01d3-4c97-986f-0533483fee14}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1520 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9840", "caller": "0x7ffbc7b97881", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbb507f000" }, { "name": "ModuleName", "value": "execmodelclient.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1521 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc727fa8c", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5caddc63-01d3-4c97-986f-0533483fee14}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1522 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc727fad3", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045e" } ], "repeated": 0, "id": 1523 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc727fae4", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000044a" } ], "repeated": 0, "id": 1524 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1525 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1526 }, { "timestamp": "2026-05-28 23:34:30,920", "thread_id": "9880", "caller": "0x7ffbc7b93f7a", "parentcaller": "0x7ffbc7020ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1527 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9880", "caller": "0x7ffbc7020cd1", "parentcaller": "0x7ffbc701f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000448" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 1528 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9880", "caller": "0x7ffbc549026b", "parentcaller": "0x7ffbc7020daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000045c" } ], "repeated": 0, "id": 1529 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9880", "caller": "0x7ffbc7b88cde", "parentcaller": "0x7ffbc7bc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xaby\t\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00jy\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1530 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9840", "caller": "0x7ffbc7c0e53f", "parentcaller": "0x7ffbc7b6faf7", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 1531 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9880", "caller": "0x7ffbc7bb6e46", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xb8\\xee\\xc5\\xe4\\xbc\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1532 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9840", "caller": "0x7ffbc7b65157", "parentcaller": "0x7ffbc7b643ea", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "policymanager.dll" } ], "repeated": 0, "id": 1533 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9880", "caller": "0x7ffbc7bb6ec0", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1534 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9880", "caller": "0x7ffbc7bb6f0e", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "hE\\xc7\\xe4\\xbc\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1535 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9840", "caller": "0x7ffbc7baf37b", "parentcaller": "0x7ffbc7baf207", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\policymanager.dll" } ], "repeated": 0, "id": 1536 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9880", "caller": "0x7ffbc7bb707b", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xe6\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xcc\\xdf^D\\x00\\x00\\x00\\\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xa2h\\x86" } ], "repeated": 0, "id": 1537 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9880", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7020e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 1538 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9880", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7020e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045c" } ], "repeated": 1, "id": 1539 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9880", "caller": "0x7ffbc71fcd6e", "parentcaller": "0x7ffbc7272ed4", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 1540 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9840", "caller": "0x7ffbc7bafc9c", "parentcaller": "0x7ffbc7bafa80", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000464" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\policymanager.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1541 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9880", "caller": "0x7ffbc727fa51", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000045e" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000044a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bc3d253-2f31-4092-9129-8ad5abf067da}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1542 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9840", "caller": "0x7ffbc7bafcfe", "parentcaller": "0x7ffbc7bafa80", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000468" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000464" }, { "name": "FileName", "value": "C:\\Windows\\System32\\policymanager.dll" } ], "repeated": 0, "id": 1543 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9880", "caller": "0x7ffbc7bb6ec0", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1544 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9880", "caller": "0x7ffbc7bb6f0e", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xc8E\\xc7\\xe4\\xbc\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1545 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9880", "caller": "0x7ffbc7bb6f37", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1546 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9880", "caller": "0x7ffbc7bb6f8f", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xf8\\xe2\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 1547 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9880", "caller": "0x7ffbc7bb7048", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00\\xda\\x10\\xf5u\r\\x8a\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00\\xd0\\xdb\\xdf^D\\x00\\x00\\x00\\xc8\\xdb\\xdf^D\\x00\\x00\\x00\\x98\\xdb\\xdf^D\\x00\\x00\\x00\\xb8\\xdb\\xdf^" } ], "repeated": 0, "id": 1548 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9840", "caller": "0x7ffbc7b64d42", "parentcaller": "0x7ffbc7b64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000468" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbbf330000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000a1000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1549 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9880", "caller": "0x7ffbc7bb707b", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xe2\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xb8\\xd9\\xdf^D\\x00\\x00\\x00H\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 1550 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9880", "caller": "0x7ffbc7b88cde", "parentcaller": "0x7ffbc7b8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xaby\t\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00jy\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1551 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9880", "caller": "0x7ffbc7bb6e46", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "(\\xed\\xc5\\xe4\\xbc\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1552 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9880", "caller": "0x7ffbc7bb6e9b", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xa0\\xe5\\xc8\\xe4\\xbc\\x01\\x00\\x00`\\x00\\x00\\x00\\\\x00W\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00p\\x00o\\x00l\\x00i\\x00c\\x00y\\x00m\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00" } ], "repeated": 0, "id": 1553 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9840", "caller": "0x7ffbc7b5fee4", "parentcaller": "0x7ffbc7b5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbbf3ce000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1554 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9880", "caller": "0x7ffbc7bb6ec0", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1555 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9840", "caller": "0x7ffbc7b5ffb5", "parentcaller": "0x7ffbc7b5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbbf3a8000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1556 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9880", "caller": "0x7ffbc7bb6f37", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1557 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9840", "caller": "0x7ffbc7b60068", "parentcaller": "0x7ffbc7b5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbbf3a8000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1558 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9880", "caller": "0x7ffbc7bb6f8f", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xb8\\xe3\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 1559 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9880", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00:\\x0c\\xf5u\r\\x8a\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x000\\xd8\\xdf^D\\x00\\x00\\x00(\\xd8\\xdf^D\\x00\\x00\\x00\\xf8\\xd7\\xdf^D\\x00\\x00\\x00\\x18\\xd8\\xdf^" } ], "repeated": 0, "id": 1560 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9880", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7020e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045c" } ], "repeated": 0, "id": 1561 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9880", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7020e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 1562 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "msvcp110_win.dll" } ], "repeated": 0, "id": 1563 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9840", "caller": "0x7ffbc7bafd68", "parentcaller": "0x7ffbc7bafa80", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000468" } ], "repeated": 0, "id": 1564 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9840", "caller": "0x7ffbc7bafd71", "parentcaller": "0x7ffbc7bafa80", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" } ], "repeated": 0, "id": 1565 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" }, { "name": "FunctionName", "value": "WindowsCreateString" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc72181a0" } ], "repeated": 0, "id": 1566 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9840", "caller": "0x7ffbc7baf37b", "parentcaller": "0x7ffbc7baf207", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msvcp110_win.dll" } ], "repeated": 0, "id": 1567 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9880", "caller": "0x7ffbc549026b", "parentcaller": "0x7ffbc545cbb0", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000448" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000045c" } ], "repeated": 0, "id": 1568 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9880", "caller": "0x7ffbc545aa1f", "parentcaller": "0x7ffbc545cb7c", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1569 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9840", "caller": "0x7ffbc7baf37b", "parentcaller": "0x7ffbc7baf207", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\msvcp110_win.dll" } ], "repeated": 0, "id": 1570 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9840", "caller": "0x7ffbc7bafc9c", "parentcaller": "0x7ffbc7baf7b0", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000464" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\msvcp110_win.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1571 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9840", "caller": "0x7ffbc7bafcfe", "parentcaller": "0x7ffbc7baf7b0", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000468" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000464" }, { "name": "FileName", "value": "C:\\Windows\\System32\\msvcp110_win.dll" } ], "repeated": 0, "id": 1572 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9840", "caller": "0x7ffbc7b64d42", "parentcaller": "0x7ffbc7b64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000468" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc42c0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0008a000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1573 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9840", "caller": "0x7ffbc7b5ffb5", "parentcaller": "0x7ffbc7b5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc430d000" }, { "name": "ModuleName", "value": "msvcp110_win.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1574 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9840", "caller": "0x7ffbc7b5ffed", "parentcaller": "0x7ffbc7b5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc430d000" }, { "name": "ModuleName", "value": "msvcp110_win.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1575 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9840", "caller": "0x7ffbc7b60068", "parentcaller": "0x7ffbc7b5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc430d000" }, { "name": "ModuleName", "value": "msvcp110_win.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1576 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9840", "caller": "0x7ffbc7b6009c", "parentcaller": "0x7ffbc7b5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc430d000" }, { "name": "ModuleName", "value": "msvcp110_win.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1577 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9840", "caller": "0x7ffbc7b65082", "parentcaller": "0x7ffbc7b679d2", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc430d000" }, { "name": "ModuleName", "value": "msvcp110_win.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1578 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9840", "caller": "0x7ffbc7bafd68", "parentcaller": "0x7ffbc7baf7b0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000468" } ], "repeated": 0, "id": 1579 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9840", "caller": "0x7ffbc7bafd71", "parentcaller": "0x7ffbc7baf7b0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" } ], "repeated": 0, "id": 1580 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9840", "caller": "0x7ffbc7b97bac", "parentcaller": "0x7ffbc7b8288a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbbf3a8000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1581 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9840", "caller": "0x7ffbc7b97fe1", "parentcaller": "0x7ffbc7b97bdd", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "35" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x12\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x02\\xc7\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x10A\\xc7\\xfb\\x7f\\x00\\x00" } ], "repeated": 0, "id": 1582 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9840", "caller": "0x7ffbc7b97bac", "parentcaller": "0x7ffbc7b8288a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc430d000" }, { "name": "ModuleName", "value": "msvcp110_win.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1583 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9840", "caller": "0x7ffbc7b97bac", "parentcaller": "0x7ffbc7b8288a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7ffbc42c0000" } ], "repeated": 0, "id": 1584 }, { "timestamp": "2026-05-28 23:34:30,936", "thread_id": "9840", "caller": "0x7ffbc7b97bac", "parentcaller": "0x7ffbc7b8288a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7ffbbf330000" } ], "repeated": 0, "id": 1585 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7b97830", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc6f28000" }, { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1586 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7b97881", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc6f28000" }, { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1587 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7baeb32", "parentcaller": "0x7ffbc7b6fad7", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000003c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 1, "id": 1588 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9840", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4d15000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1589 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9840", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\msvcp110_win" }, { "name": "BaseAddress", "value": "0x7ffbc42c0000" }, { "name": "InitRoutine", "value": "0x7ffbc4305870" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 1590 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9840", "caller": "0x7ffbc7bbc2c7", "parentcaller": "0x7ffbc7bbc05a", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\policymanager" }, { "name": "BaseAddress", "value": "0x7ffbbf330000" }, { "name": "InitRoutine", "value": "0x7ffbbf339ed0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 1591 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9840", "caller": "0x7ffbc7b97830", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbb507f000" }, { "name": "ModuleName", "value": "execmodelclient.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1592 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7c0e53f", "parentcaller": "0x7ffbc7b6faf7", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 1593 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9840", "caller": "0x7ffbc7b97881", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbb507f000" }, { "name": "ModuleName", "value": "execmodelclient.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1594 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7b65157", "parentcaller": "0x7ffbc7b643ea", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "usermgrcli.dll" } ], "repeated": 0, "id": 1595 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7baf37b", "parentcaller": "0x7ffbc7baf207", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\usermgrcli.dll" } ], "repeated": 0, "id": 1596 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7bafc9c", "parentcaller": "0x7ffbc7bafa80", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000045c" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\usermgrcli.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1597 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7bafcfe", "parentcaller": "0x7ffbc7bafa80", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000460" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000045c" }, { "name": "FileName", "value": "C:\\Windows\\System32\\usermgrcli.dll" } ], "repeated": 0, "id": 1598 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7b64d42", "parentcaller": "0x7ffbc7b64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000460" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc0580000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00016000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1599 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7b5fee4", "parentcaller": "0x7ffbc7b5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc0593000" }, { "name": "ModuleName", "value": "usermgrcli.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1600 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7b5ffb5", "parentcaller": "0x7ffbc7b5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc058c000" }, { "name": "ModuleName", "value": "usermgrcli.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1601 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7b5ffed", "parentcaller": "0x7ffbc7b5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc058c000" }, { "name": "ModuleName", "value": "usermgrcli.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1602 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7b60068", "parentcaller": "0x7ffbc7b5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc058c000" }, { "name": "ModuleName", "value": "usermgrcli.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1603 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7b6009c", "parentcaller": "0x7ffbc7b5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc058c000" }, { "name": "ModuleName", "value": "usermgrcli.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1604 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7b65082", "parentcaller": "0x7ffbc7b679d2", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc058b000" }, { "name": "ModuleName", "value": "usermgrcli.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1605 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7bafd68", "parentcaller": "0x7ffbc7bafa80", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000460" } ], "repeated": 0, "id": 1606 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7bafd71", "parentcaller": "0x7ffbc7bafa80", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045c" } ], "repeated": 0, "id": 1607 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7b97bac", "parentcaller": "0x7ffbc7b8288a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc058b000" }, { "name": "ModuleName", "value": "usermgrcli.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1608 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7b97bac", "parentcaller": "0x7ffbc7b8288a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\usermgrcli" }, { "name": "DllBase", "value": "0x7ffbc0580000" } ], "repeated": 0, "id": 1609 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7bbc2c7", "parentcaller": "0x7ffbc7bbc05a", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\usermgrcli" }, { "name": "BaseAddress", "value": "0x7ffbc0580000" }, { "name": "InitRoutine", "value": "0x7ffbc0584250" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 1610 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7b97830", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbb0a1a000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1611 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7b97881", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbb0a1a000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1612 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7b93f7a", "parentcaller": "0x7ffbc7020ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1613 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7207b74", "parentcaller": "0x7ffbc72053d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000376" }, { "name": "SubKey", "value": "CLSID\\{0C9281F9-6DA1-4006-8729-DE6E6B61581C}" }, { "name": "Handle", "value": "0x0000046a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0C9281F9-6DA1-4006-8729-DE6E6B61581C}" } ], "repeated": 0, "id": 1614 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1615 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1616 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xc4\\xdf^D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00j\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00\\xe0\\xc5\\xdf^D\\x00\\x00\\x00" } ], "repeated": 0, "id": 1617 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\TreatAs" } ], "repeated": 0, "id": 1618 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1619 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000046a" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\TreatAs" } ], "repeated": 0, "id": 1620 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc72922e1", "parentcaller": "0x7ffbc7207c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1621 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72081f5", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000046a" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 1622 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000046a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\(Default)" } ], "repeated": 0, "id": 1623 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72087bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000046a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Windows Push Notification Platform" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\(Default)" } ], "repeated": 0, "id": 1624 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7208485", "parentcaller": "0x7ffbc720829e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000046a" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocServer32" } ], "repeated": 0, "id": 1625 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1626 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1627 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xc3\\xdf^D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00j\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00p\\xc4\\xdf^D\\x00\\x00\\x00" } ], "repeated": 0, "id": 1628 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler32" } ], "repeated": 0, "id": 1629 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1630 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000046a" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler32" } ], "repeated": 0, "id": 1631 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1632 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1633 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xc3\\xdf^D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00j\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00p\\xc4\\xdf^D\\x00\\x00\\x00" } ], "repeated": 0, "id": 1634 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler" } ], "repeated": 0, "id": 1635 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1636 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000046a" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler" } ], "repeated": 0, "id": 1637 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7208010", "parentcaller": "0x7ffbc72053d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000046a" } ], "repeated": 0, "id": 1638 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1639 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1640 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc5453a9c", "parentcaller": "0x7ffbc5453529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1641 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc5453f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000110" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1642 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc5453f76", "parentcaller": "0x7ffbc54d4fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000468" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000110" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers" } ], "repeated": 0, "id": 1643 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc5452fe4", "parentcaller": "0x7ffbc727f195", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000468" }, { "name": "ValueName", "value": "WaitForRestore" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers\\WaitForRestore" } ], "repeated": 0, "id": 1644 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc5453018", "parentcaller": "0x7ffbc727f195", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000468" } ], "repeated": 0, "id": 1645 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc5453a9c", "parentcaller": "0x7ffbc5453529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 1646 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc5453f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000110" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1647 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc5453f76", "parentcaller": "0x7ffbc54d4fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000468" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000110" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\OLE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE" } ], "repeated": 0, "id": 1648 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc5452fe4", "parentcaller": "0x7ffbc727ca47", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000468" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\ActivateOnHostFlags" } ], "repeated": 0, "id": 1649 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc5453018", "parentcaller": "0x7ffbc727ca47", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000468" } ], "repeated": 0, "id": 1650 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4ca0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1651 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7051630", "parentcaller": "0x7ffbc70512cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1652 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c93000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1653 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c94000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1654 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc71f6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000046c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1655 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc728224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1656 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc72022bf", "parentcaller": "0x7ffbc727fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}" }, { "name": "Handle", "value": "0x00000462" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}" } ], "repeated": 0, "id": 1657 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc727fa51", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000462" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000466" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1658 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc727fa8c", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000466" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1659 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc727fad3", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000466" } ], "repeated": 0, "id": 1660 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc727fae4", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000462" } ], "repeated": 0, "id": 1661 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7207b74", "parentcaller": "0x7ffbc72053d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000376" }, { "name": "SubKey", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "Handle", "value": "0x00000462" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 1662 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1663 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1664 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xb4\\xdf^D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00b\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00\\xc0\\xb5\\xdf^D\\x00\\x00\\x00" } ], "repeated": 0, "id": 1665 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 1666 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1667 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000462" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 1668 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc72922e1", "parentcaller": "0x7ffbc7207c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1669 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72081f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000462" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 1670 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000462" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 1671 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72087bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000462" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 1672 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc7208485", "parentcaller": "0x7ffbc720829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000462" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00000466" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32" } ], "repeated": 0, "id": 1673 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000466" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 1674 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000466" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 1675 }, { "timestamp": "2026-05-28 23:34:30,952", "thread_id": "9880", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72087bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000466" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 1676 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7208d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000466" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 1677 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc720855f", "parentcaller": "0x7ffbc720829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000466" } ], "repeated": 0, "id": 1678 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1679 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1680 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xb3\\xdf^D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00b\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00P\\xb4\\xdf^D\\x00\\x00\\x00" } ], "repeated": 0, "id": 1681 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 1682 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1683 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000462" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 1684 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1685 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1686 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xb3\\xdf^D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00b\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00P\\xb4\\xdf^D\\x00\\x00\\x00" } ], "repeated": 0, "id": 1687 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 1688 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1689 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000462" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 1690 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc7208010", "parentcaller": "0x7ffbc72053d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000462" } ], "repeated": 0, "id": 1691 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1692 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1693 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc7207b74", "parentcaller": "0x7ffbc72053d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000376" }, { "name": "SubKey", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "Handle", "value": "0x00000462" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 1694 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1695 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1696 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xb1\\xdf^D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00b\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00\\x80\\xb2\\xdf^D\\x00\\x00\\x00" } ], "repeated": 0, "id": 1697 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 1698 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1699 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000462" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 1700 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc72922e1", "parentcaller": "0x7ffbc7207c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1701 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4ca4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1702 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72081f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000462" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 1703 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000462" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 1704 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbc7b97881", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbbf3ce000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1705 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72087bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000462" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 1706 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf3371e2", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps" }, { "name": "Handle", "value": "0x00000464" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps" } ], "repeated": 0, "id": 1707 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf33723c", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\PolicyType" } ], "repeated": 0, "id": 1708 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc7208485", "parentcaller": "0x7ffbc720829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000462" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00000472" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32" } ], "repeated": 0, "id": 1709 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf3372a8", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "139296" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Behavior" } ], "repeated": 0, "id": 1710 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000472" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 1711 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf33739f", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 1712 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000472" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 1713 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbc7b97881", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbbf3ce000" }, { "name": "ModuleName", "value": "policymanager.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1714 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf3375df", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "Data", "value": "LetAppsRunInBackground_UserInControlOfTheseApps" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyname" } ], "repeated": 0, "id": 1715 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf337647", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath" } ], "repeated": 0, "id": 1716 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf33776a", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath" } ], "repeated": 0, "id": 1717 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7208d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000472" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 1718 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc720855f", "parentcaller": "0x7ffbc720829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000472" } ], "repeated": 0, "id": 1719 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf3377f6", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "grouppolicyismultisz" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyismultisz" } ], "repeated": 0, "id": 1720 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1721 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf337836", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "grouppolicymultiszSeparatorChar" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicymultiszSeparatorChar" } ], "repeated": 0, "id": 1722 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 1723 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf3379b1", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataDevice" } ], "repeated": 0, "id": 1724 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1725 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf337a6c", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataBoth" } ], "repeated": 0, "id": 1726 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbbf33db1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\30Value" } ], "repeated": 0, "id": 1727 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf337ca8", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Value" } ], "repeated": 0, "id": 1728 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf3376a9", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" } ], "repeated": 0, "id": 1729 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720a825", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000462" }, { "name": "ValueName", "value": "AppID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\AppID" } ], "repeated": 0, "id": 1730 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf335d7c", "parentcaller": "0x7ffbbf335ac0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" } ], "repeated": 0, "id": 1731 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1732 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xaf\\xdf^D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00b\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00P\\xb0\\xdf^D\\x00\\x00\\x00" } ], "repeated": 0, "id": 1733 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer" } ], "repeated": 0, "id": 1734 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000462" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1735 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf3371e2", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps" }, { "name": "Handle", "value": "0x00000464" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps" } ], "repeated": 0, "id": 1736 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf33723c", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\PolicyType" } ], "repeated": 0, "id": 1737 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc720ad16", "parentcaller": "0x7ffbc72083b8", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000376" }, { "name": "SubKey", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "Handle", "value": "0x00000472" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 1738 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf33732c", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\MergeAlgorithm" } ], "repeated": 0, "id": 1739 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf33739f", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 1740 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc7208010", "parentcaller": "0x7ffbc72053d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000462" } ], "repeated": 0, "id": 1741 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirect" } ], "repeated": 0, "id": 1742 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf33755e", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname" } ], "repeated": 0, "id": 1743 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc72022bf", "parentcaller": "0x7ffbc72025e9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "Handle", "value": "0x00000462" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 1744 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf3375df", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "Data", "value": "LetAppsRunInBackground_ForceAllowTheseApps" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname" } ], "repeated": 0, "id": 1745 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf337647", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath" } ], "repeated": 0, "id": 1746 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1747 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1748 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf33776a", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath" } ], "repeated": 0, "id": 1749 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf3377f6", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "grouppolicyismultisz" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyismultisz" } ], "repeated": 0, "id": 1750 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf337836", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "grouppolicymultiszSeparatorChar" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicymultiszSeparatorChar" } ], "repeated": 0, "id": 1751 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf3378f6", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataUser" } ], "repeated": 0, "id": 1752 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf3379b1", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataDevice" } ], "repeated": 0, "id": 1753 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf337a6c", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataBoth" } ], "repeated": 0, "id": 1754 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbbf33db1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\30Value" } ], "repeated": 0, "id": 1755 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf337ca8", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Value" } ], "repeated": 0, "id": 1756 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf3376a9", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" } ], "repeated": 0, "id": 1757 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf335c61", "parentcaller": "0x7ffbbf335ac0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } ], "repeated": 0, "id": 1758 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf335d7c", "parentcaller": "0x7ffbbf335ac0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" } ], "repeated": 0, "id": 1759 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf3371e2", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps" }, { "name": "Handle", "value": "0x00000464" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps" } ], "repeated": 0, "id": 1760 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf33723c", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\PolicyType" } ], "repeated": 0, "id": 1761 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf3372a8", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "139296" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Behavior" } ], "repeated": 0, "id": 1762 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf33732c", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\MergeAlgorithm" } ], "repeated": 0, "id": 1763 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf33739f", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 1764 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf337402", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirect" } ], "repeated": 0, "id": 1765 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf33755e", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname" } ], "repeated": 0, "id": 1766 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbc7226acf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OneCoreUAPCommonProxyStub.dll" }, { "name": "ModuleHandle", "value": "0x7ffbbe780000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbbe796540" } ], "repeated": 0, "id": 1767 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbc7226ae8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "OneCoreUAPCommonProxyStub.dll" }, { "name": "ModuleHandle", "value": "0x7ffbbe780000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 1768 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf3375df", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "Data", "value": "LetAppsRunInBackground_ForceDenyTheseApps" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname" } ], "repeated": 0, "id": 1769 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9880", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbc7226b08", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OneCoreUAPCommonProxyStub.dll" }, { "name": "ModuleHandle", "value": "0x7ffbbe780000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbbe7965f0" } ], "repeated": 0, "id": 1770 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf337647", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicypath" } ], "repeated": 0, "id": 1771 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf33776a", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicypath" } ], "repeated": 0, "id": 1772 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf3377f6", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "grouppolicyismultisz" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyismultisz" } ], "repeated": 0, "id": 1773 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf337836", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "grouppolicymultiszSeparatorChar" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicymultiszSeparatorChar" } ], "repeated": 0, "id": 1774 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf3378f6", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataUser" } ], "repeated": 0, "id": 1775 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf3379b1", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataDevice" } ], "repeated": 0, "id": 1776 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf337a6c", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataBoth" } ], "repeated": 0, "id": 1777 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbbf33db1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\30Value" } ], "repeated": 0, "id": 1778 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf337ca8", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Value" } ], "repeated": 0, "id": 1779 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf3376a9", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" } ], "repeated": 0, "id": 1780 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf335c61", "parentcaller": "0x7ffbbf335ac0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } ], "repeated": 0, "id": 1781 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf335d7c", "parentcaller": "0x7ffbbf335ac0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" } ], "repeated": 0, "id": 1782 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf3371e2", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground" }, { "name": "Handle", "value": "0x00000464" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground" } ], "repeated": 0, "id": 1783 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf33723c", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\PolicyType" } ], "repeated": 0, "id": 1784 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf3372a8", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "139296" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Behavior" } ], "repeated": 0, "id": 1785 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf33732c", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\MergeAlgorithm" } ], "repeated": 0, "id": 1786 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf33739f", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 1787 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf337402", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirect" } ], "repeated": 0, "id": 1788 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf33755e", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname" } ], "repeated": 0, "id": 1789 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf3375df", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "Data", "value": "LetAppsRunInBackground" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname" } ], "repeated": 0, "id": 1790 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf337647", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath" } ], "repeated": 0, "id": 1791 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf33776a", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath" } ], "repeated": 0, "id": 1792 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf3377f6", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "grouppolicyismultisz" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyismultisz" } ], "repeated": 0, "id": 1793 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf337836", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "grouppolicymultiszSeparatorChar" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicymultiszSeparatorChar" } ], "repeated": 0, "id": 1794 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf3378f6", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataUser" } ], "repeated": 0, "id": 1795 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf3379b1", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataDevice" } ], "repeated": 0, "id": 1796 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf337a6c", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataBoth" } ], "repeated": 0, "id": 1797 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbbf33db1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\30Value" } ], "repeated": 0, "id": 1798 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf337b73", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Value" } ], "repeated": 0, "id": 1799 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf3376a9", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" } ], "repeated": 0, "id": 1800 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf336e85", "parentcaller": "0x7ffbbf336097", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } ], "repeated": 0, "id": 1801 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbbf336d68", "parentcaller": "0x7ffbbf336097", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" } ], "repeated": 0, "id": 1802 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbc728dd9d", "parentcaller": "0x7ffbc7227428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000464" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000344" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.StateRepository.User" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User" } ], "repeated": 0, "id": 1803 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbc728ddf7", "parentcaller": "0x7ffbc7227428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000464" }, { "name": "KeyInformation", "value": "\\xfffci\\x0e\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00J\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00U\\x00s\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1a\\x00\\x00\\x00\\xfffb\\x7f\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EM\\xffc7\\xfffb\\x7f\\x00\\x00\\xfff8\\xff94\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffe7\\xff9f^D\\x00\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00@\\xffbb\\xffc7\\xffe4\\xffbc\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00\\xffb4\\x03\\xffac\\xffbcP\\xffe2\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0*\\xffc6\\xffe4\\xffbc\\x01\\x00\\x00\\xfff8\\xff94\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\xffd0\\xff94\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d!\\xffc7\\xfffb\\x7f\\x00\\x00@\\xffbb\\xffc7\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff94\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00@\\xffbb\\xffc7\\xffe4\\xffbc\\x01\\x00\\x00\\xffd0*\\xffc6\\xffe4\\xffbc\\x01\\x00\\x000\\xffec\\xffc5\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s!\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0*\\xffc6\\xffe4\\xffbc\\x01\\x00\\x00p\\xffb6\\xffc7\\xffe4\\xffbc\\x01\\x00\\x00p\\xffb6\\xffc7\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffbb\\xffc7\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xffb6\\xffc7\\xffe4\\xffbc\\x01\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00@\\xffbb\\xffc7\\xffe4\\xffbc\\x01\\x00\\x000\\xffec\\xffc5\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffe8\\xff9f^D\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffb5\\xffc7\\xffe4\\xffbc\\x01\\x00\\x00\\xffd0\\xff94\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 1804 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7289cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivationType" } ], "repeated": 0, "id": 1805 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbc71e7deb", "parentcaller": "0x7ffbc7298ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "Server" }, { "name": "Data", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Server" } ], "repeated": 0, "id": 1806 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbc71e7deb", "parentcaller": "0x7ffbc72a00bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\DllPath" } ], "repeated": 0, "id": 1807 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7289cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Threading" } ], "repeated": 0, "id": 1808 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7289cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\TrustLevel" } ], "repeated": 0, "id": 1809 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbc71ec0fc", "parentcaller": "0x7ffbc7284170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000464" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\CustomAttributes" } ], "repeated": 0, "id": 1810 }, { "timestamp": "2026-05-28 23:34:30,967", "thread_id": "9840", "caller": "0x7ffbc71e7deb", "parentcaller": "0x7ffbc7298ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\RemoteServer" } ], "repeated": 0, "id": 1811 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7289cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateAsUser" } ], "repeated": 0, "id": 1812 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7289cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateInSharedBroker" } ], "repeated": 0, "id": 1813 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7289cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 1814 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7292222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Permissions" } ], "repeated": 0, "id": 1815 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc727fae4", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000472" } ], "repeated": 0, "id": 1816 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7289cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateOnHostFlags" } ], "repeated": 0, "id": 1817 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc72274a2", "parentcaller": "0x7ffbc72267e6", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000478" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000358" }, { "name": "ObjectAttributesName", "value": "Server" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server" } ], "repeated": 0, "id": 1818 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc728dd9d", "parentcaller": "0x7ffbc7227428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000047c" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000478" }, { "name": "ObjectAttributesName", "value": "StateRepository" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository" } ], "repeated": 0, "id": 1819 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc728ddf7", "parentcaller": "0x7ffbc7227428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000047c" }, { "name": "KeyInformation", "value": "\\xffcek|\\xffd3\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00\\x1e\\x00\\x00\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00\\x00\\x00\\xff84\\xffb9\\xff80\\xffe6\\xffbc\\x01\\x00\\x00\\xff90\\xffc7s\\xff86\\xfffb\\x7f\\x00\\x00\\xffa2t\"\\xffc7\\xfffb\\x7f\\x00\\x00\\xffd9LD\\xff86\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00:\\x1c\\xffb5u\r\\xff8a\\x00\\x00x\\xff95\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\xff87\\x00\\xfffb\\xff87\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\x00\\xfffb\\xff87\\xfffb\\x7f\\x00\\x00X\\xffe3\\xff9f^D\\x00\\x00\\x00\\xffaa\\x1e\\xffb5u\r\\xff8a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffac/\\xffc6\\xffe4\\xffbc\\x01\\x00\\x00hO\\xffc3\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x19\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\xffa0(\\xffc6\\xffe4\\xffbc\\x01\\x00\\x00\\xffa0\\xffe3\\xff9f^D\\x00\\x00\\x00\\xffe4IF\\xff86\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xffb9\\x00\\xfffb\\xff87\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff9d\\xffd0h\\xff86\\xfffb\\x7f\\x00\\x00\\xffb8\\xffcfh\\xff86\\xfffb\\x7f\\x00\\x00\\xffa0(\\xffc6\\xffe4\\xffbc\\x01\\x00\\x00\\xfff8\\xff81h\\xff86\\xfffb\\x7f\\x00\\x00\\x19\\x01\\x02\\x00\\xffbc\\x01\\x00\\x00h\\xffd0h\\xff86\\xfffb\\x7f\\x00\\x00X\\x03\\x00\\x00\\x00\\x00\\x00\\x00P\\xffd0h\\xff86\\xfffb\\x7f\\x00\\x00\\xff90\\xffe3\\xff9f^D\\x00\\x00\\x00\\xff98\\xff85h\\xff86\\xfffb\\x7f\\x00\\x00\\xffa0\\xffe3\\xff9f^D\\x00\\x00\\x00\\xffd0G\\xffc7\\xffe4\\xffbc\\x01\\x00\\x00\\xffb0t\"\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00\\xffa0\\xffe5\\xff9f^D\\x00\\x00\\x00\\xffa0(\\xffc6\\xffe4\\xffbc\\x01\\x00\\x00P+\\xffc6\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\xffecG\\xffc7\\xffe4\\xffbc\\x01\\x00\\x000\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00X\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffe3\\xff9f^D\\x00\\x00\\x00@\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90(\\xffc6\\xffe4\\xffbc\\x01\\x00\\x00\\x19h\"\\xffc7\\xfffb\\x7f\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 1820 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc71e7deb", "parentcaller": "0x7ffbc72a00bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000047c" }, { "name": "ValueName", "value": "ExePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath" } ], "repeated": 0, "id": 1821 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc71e7deb", "parentcaller": "0x7ffbc72a00bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000047c" }, { "name": "ValueName", "value": "CommandLine" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine" } ], "repeated": 0, "id": 1822 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7289cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047c" }, { "name": "ValueName", "value": "IdentityType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType" } ], "repeated": 0, "id": 1823 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7292222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000047c" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Type", "value": "0x7ffb00000003" }, { "name": "DataLength", "value": "184" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions" } ], "repeated": 0, "id": 1824 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7292222", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047c" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Data", "value": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions" } ], "repeated": 0, "id": 1825 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc71e7deb", "parentcaller": "0x7ffbc72a9d80", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000047c" }, { "name": "ValueName", "value": "ActivatableClasses" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses" } ], "repeated": 0, "id": 1826 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7289cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047c" }, { "name": "ValueName", "value": "ServerType" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType" } ], "repeated": 0, "id": 1827 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc71e7deb", "parentcaller": "0x7ffbc7298ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000047c" }, { "name": "ValueName", "value": "AppId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId" } ], "repeated": 0, "id": 1828 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc71e7deb", "parentcaller": "0x7ffbc7298ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047c" }, { "name": "ValueName", "value": "Identity" }, { "name": "Data", "value": "nt authority\\system" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity" } ], "repeated": 0, "id": 1829 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc71e7deb", "parentcaller": "0x7ffbc7298ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047c" }, { "name": "ValueName", "value": "ServiceName" }, { "name": "Data", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName" } ], "repeated": 0, "id": 1830 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7289cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000047c" }, { "name": "ValueName", "value": "ExplicitPsmActivationType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType" } ], "repeated": 0, "id": 1831 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc71ec0fc", "parentcaller": "0x7ffbc7284170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000047c" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CustomAttributes" } ], "repeated": 0, "id": 1832 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7287226", "parentcaller": "0x7ffbc728ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047c" } ], "repeated": 0, "id": 1833 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7287226", "parentcaller": "0x7ffbc728ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" } ], "repeated": 0, "id": 1834 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c95000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1835 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c96000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1836 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4ca5000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1837 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4ca6000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1838 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc728224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1839 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc72022bf", "parentcaller": "0x7ffbc727fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{84103CCB-2FD7-4D6C-962E-5D8582B4C720}" }, { "name": "Handle", "value": "0x0000043a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{84103CCB-2FD7-4D6C-962E-5D8582B4C720}" } ], "repeated": 0, "id": 1840 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc727fa51", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000043a" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000436" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{84103ccb-2fd7-4d6c-962e-5d8582b4c720}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1841 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc727fa8c", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000436" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{84103ccb-2fd7-4d6c-962e-5d8582b4c720}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1842 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc727fad3", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000436" } ], "repeated": 0, "id": 1843 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc727fae4", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000043a" } ], "repeated": 0, "id": 1844 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7207b74", "parentcaller": "0x7ffbc72053d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000376" }, { "name": "SubKey", "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "Handle", "value": "0x0000043a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 1845 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000043a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1846 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000043a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1847 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xbf\\x9f^D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00:\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00`\\xc0\\x9f^D\\x00\\x00\\x00" } ], "repeated": 0, "id": 1848 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 1849 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000043a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1850 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000043a" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 1851 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1852 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1853 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72081f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000043a" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 1854 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000043a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)" } ], "repeated": 0, "id": 1855 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72087bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000043a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)" } ], "repeated": 0, "id": 1856 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7208485", "parentcaller": "0x7ffbc720829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000043a" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00000436" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32" } ], "repeated": 0, "id": 1857 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000436" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 1858 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000436" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 1859 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72087bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000436" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\\\Windows.StateRepositoryPS.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 1860 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7208d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000436" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 1861 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc720855f", "parentcaller": "0x7ffbc720829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000436" } ], "repeated": 0, "id": 1862 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000043a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1863 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000043a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1864 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xbd\\x9f^D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00:\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00\\xf0\\xbe\\x9f^D\\x00\\x00\\x00" } ], "repeated": 0, "id": 1865 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" } ], "repeated": 0, "id": 1866 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000043a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1867 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000043a" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" } ], "repeated": 0, "id": 1868 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000043a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1869 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000043a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1870 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xbd\\x9f^D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00:\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00\\xf0\\xbe\\x9f^D\\x00\\x00\\x00" } ], "repeated": 0, "id": 1871 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" } ], "repeated": 0, "id": 1872 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000043a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1873 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000043a" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" } ], "repeated": 0, "id": 1874 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7208010", "parentcaller": "0x7ffbc72053d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000043a" } ], "repeated": 0, "id": 1875 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1876 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1877 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc728224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1878 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000376" }, { "name": "SubKey", "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "Handle", "value": "0x0000043a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 1879 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000043a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1880 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000043a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1881 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xbc\\x9f^D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00:\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00 \\xbd\\x9f^D\\x00\\x00\\x00" } ], "repeated": 0, "id": 1882 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 1883 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000043a" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 1884 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc72922e1", "parentcaller": "0x7ffbc7207c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000043a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1885 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72081f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000043a" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 1886 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000043a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)" } ], "repeated": 0, "id": 1887 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc727fa8c", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000472" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1888 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc727fad3", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000472" } ], "repeated": 0, "id": 1889 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72087bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000043a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)" } ], "repeated": 0, "id": 1890 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc727fae4", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000436" } ], "repeated": 0, "id": 1891 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1892 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1893 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7208485", "parentcaller": "0x7ffbc720829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000043a" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00000436" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32" } ], "repeated": 0, "id": 1894 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000436" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 1895 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000436" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 1896 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72087bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000436" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\\\Windows.StateRepositoryPS.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 1897 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7208d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000436" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 1898 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc720855f", "parentcaller": "0x7ffbc720829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000436" } ], "repeated": 0, "id": 1899 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000043a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1900 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000043a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1901 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xba\\x9f^D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00:\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00\\xb0\\xbb\\x9f^D\\x00\\x00\\x00" } ], "repeated": 0, "id": 1902 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" } ], "repeated": 0, "id": 1903 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000043a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1904 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000043a" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" } ], "repeated": 0, "id": 1905 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000043a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1906 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000043a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1907 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xba\\x9f^D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00:\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00\\xb0\\xbb\\x9f^D\\x00\\x00\\x00" } ], "repeated": 0, "id": 1908 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" } ], "repeated": 0, "id": 1909 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000043a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1910 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000043a" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" } ], "repeated": 0, "id": 1911 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc720ab08", "parentcaller": "0x7ffbc720a7d9", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000043a" }, { "name": "SubKey", "value": "LocalServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer32" } ], "repeated": 0, "id": 1912 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720a825", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000043a" }, { "name": "ValueName", "value": "AppID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID" } ], "repeated": 0, "id": 1913 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000043a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1914 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc72022bf", "parentcaller": "0x7ffbc727fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{A819F3DE-60AA-5159-8407-F0A7FB1F6832}" }, { "name": "Handle", "value": "0x00000476" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{A819F3DE-60AA-5159-8407-F0A7FB1F6832}" } ], "repeated": 0, "id": 1915 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer" } ], "repeated": 0, "id": 1916 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000043a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1917 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000043a" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer" } ], "repeated": 0, "id": 1918 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc727fa51", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000476" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000466" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{a819f3de-60aa-5159-8407-f0a7fb1f6832}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1919 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc720ad4d", "parentcaller": "0x7ffbc72083b8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000436" }, { "name": "SubKey", "value": "Elevation" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\Elevation" } ], "repeated": 0, "id": 1920 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc720adb1", "parentcaller": "0x7ffbc72083b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000436" } ], "repeated": 0, "id": 1921 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7208010", "parentcaller": "0x7ffbc72053d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000043a" } ], "repeated": 0, "id": 1922 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc727fa8c", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000466" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{a819f3de-60aa-5159-8407-f0a7fb1f6832}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1923 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc727fad3", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000466" } ], "repeated": 0, "id": 1924 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc727fae4", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000476" } ], "repeated": 0, "id": 1925 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1926 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1927 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc72022bf", "parentcaller": "0x7ffbc72025e9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "Handle", "value": "0x0000043a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 1928 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7020cd1", "parentcaller": "0x7ffbc701f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000474" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 1929 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc549026b", "parentcaller": "0x7ffbc7020daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000464" } ], "repeated": 0, "id": 1930 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7b88cde", "parentcaller": "0x7ffbc7bc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xaby\t\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00jy\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1931 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xd8\\xec\\xc5\\xe4\\xbc\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00n\\x00t\\x00 \\x00a\\x00u\\x00t\\x00h\\x00o\\x00r\\x00i\\x00t\\x00y\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1932 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6e9b", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "@\\xeb\\xc8\\xe4\\xbc\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00F\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1933 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6ec0", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1934 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6f0e", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "xG\\xc7\\xe4\\xbc\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1935 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6f37", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1936 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6f8f", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xf8\\xe5\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 1937 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb7048", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00\\x1a\n\\xf5u\r\\x8a\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00\\x10\\xd2\\xdf^D\\x00\\x00\\x00\\x08\\xd2\\xdf^D\\x00\\x00\\x00\\xd8\\xd1\\xdf^D\\x00\\x00\\x00\\xf8\\xd1\\xdf^" } ], "repeated": 0, "id": 1938 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7b88cde", "parentcaller": "0x7ffbc7b8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xaby\t\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00jy\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1939 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6e46", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "x\\xed\\xc5\\xe4\\xbc\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\xc0\\xa3@\\xc7\\xfb\\x7f\\x00\\x00Y\\x00S\\x00T\\x00E\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00s\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x00l\\x00" } ], "repeated": 0, "id": 1940 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6e9b", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "@\\xe8\\xc8\\xe4\\xbc\\x01\\x00\\x00`\\x00\\x00\\x00\\xfb\\x8e\\xca\\xc5\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x003\\x001\\x00p\\xe7\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1941 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6f0e", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "XI\\xc7\\xe4\\xbc\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1942 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6f37", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1943 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.StateRepositoryPS" }, { "name": "DllBase", "value": "0x7ffbb5d90000" } ], "repeated": 0, "id": 1944 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6f8f", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x98\\xe8\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 1945 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb7048", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00z\\x06\\xf5u\r\\x8a\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00p\\xce\\xdf^D\\x00\\x00\\x00h\\xce\\xdf^D\\x00\\x00\\x008\\xce\\xdf^D\\x00\\x00\\x00X\\xce\\xdf^" } ], "repeated": 0, "id": 1946 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb707b", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xe8\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xcc\\xdf^D\\x00\\x00\\x00d\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 1947 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7020e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000474" } ], "repeated": 0, "id": 1948 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7020e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" } ], "repeated": 2, "id": 1949 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" }, { "name": "FunctionName", "value": "WindowsDeleteString" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7217690" } ], "repeated": 0, "id": 1950 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7272ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" } ], "repeated": 2, "id": 1951 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\Windows.StateRepositoryPS.dll" }, { "name": "BaseAddress", "value": "0x7ffbb5d90000" } ], "repeated": 0, "id": 1952 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbb5d90000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\\\Windows.StateRepositoryPS.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 1953 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbc7226acf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "Windows.StateRepositoryPS.dll" }, { "name": "ModuleHandle", "value": "0x7ffbb5d90000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbb5d97340" } ], "repeated": 0, "id": 1954 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbc7226ae8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "Windows.StateRepositoryPS.dll" }, { "name": "ModuleHandle", "value": "0x7ffbb5d90000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 1955 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbc7226b08", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "Windows.StateRepositoryPS.dll" }, { "name": "ModuleHandle", "value": "0x7ffbb5d90000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbb5d97380" } ], "repeated": 0, "id": 1956 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7272ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" } ], "repeated": 0, "id": 1957 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc72022bf", "parentcaller": "0x7ffbc727fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}" }, { "name": "Handle", "value": "0x00000466" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}" } ], "repeated": 0, "id": 1958 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc727fa51", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000466" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000472" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1959 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1960 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b93f7a", "parentcaller": "0x7ffbc7020ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1961 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc727fa8c", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000472" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1962 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc727fad3", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000472" } ], "repeated": 0, "id": 1963 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc727fae4", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000466" } ], "repeated": 0, "id": 1964 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1965 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1966 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7b93f7a", "parentcaller": "0x7ffbc7020ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1967 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7020cd1", "parentcaller": "0x7ffbc701f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000464" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 1968 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc549026b", "parentcaller": "0x7ffbc7020daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000470" } ], "repeated": 0, "id": 1969 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7b88cde", "parentcaller": "0x7ffbc7bc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xaby\t\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00jy\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1970 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6e46", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "x\\xed\\xc5\\xe4\\xbc\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\xc0\\xa3@\\xc7\\xfb\\x7f\\x00\\x00Y\\x00S\\x00T\\x00E\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00s\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x00l\\x00" } ], "repeated": 0, "id": 1971 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6e9b", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00\\x19\\xc6\\xe4\\xbc\\x01\\x00\\x00`\\x00\\x00\\x00\\x82\\xb4\\xc7 \\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x1c\\xc6\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1972 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6ec0", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1973 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6f0e", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "HJ\\xc7\\xe4\\xbc\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1974 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6f37", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1975 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6f8f", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd8\\x1d\\xc6\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 1976 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb7048", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00\\xda\\x10\\xf5u\r\\x8a\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00\\xd0\\xdb\\xdf^D\\x00\\x00\\x00\\xc8\\xdb\\xdf^D\\x00\\x00\\x00\\x98\\xdb\\xdf^D\\x00\\x00\\x00\\xb8\\xdb\\xdf^" } ], "repeated": 0, "id": 1977 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb707b", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x1d\\xc6\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xb8\\xd9\\xdf^D\\x00\\x00\\x00p\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 1978 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7b88cde", "parentcaller": "0x7ffbc7b8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xaby\t\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00jy\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1979 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6e46", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x18\\xb9\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00-\\x002\\x001\\x00-\\x003\\x009\\x006\\x008\\x006\\x008\\x006\\x000\\x004\\x000\\x00-\\x003\\x002\\x001\\x000\\x002\\x007\\x009\\x004\\x006\\x003\\x00-\\x00" } ], "repeated": 0, "id": 1980 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6e9b", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": " \\xe4\\xc8\\xe4\\xbc\\x01\\x00\\x00`\\x00\\x00\\x00\\x84\\x07\\xf0\\xa7\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1981 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6ec0", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1982 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6f0e", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x98K\\xc7\\xe4\\xbc\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1983 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6f37", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1984 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6f8f", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "x\\xe1\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 1985 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb7048", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00:\\x0c\\xf5u\r\\x8a\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x000\\xd8\\xdf^D\\x00\\x00\\x00(\\xd8\\xdf^D\\x00\\x00\\x00\\xf8\\xd7\\xdf^D\\x00\\x00\\x00\\x18\\xd8\\xdf^" } ], "repeated": 0, "id": 1986 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb707b", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe1\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x18\\xd6\\xdf^D\\x00\\x00\\x00p\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 1987 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7020e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" } ], "repeated": 0, "id": 1988 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc72022bf", "parentcaller": "0x7ffbc727fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{5232F8EA-49C7-4840-BFBB-66E785689E88}" }, { "name": "Handle", "value": "0x00000482" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5232F8EA-49C7-4840-BFBB-66E785689E88}" } ], "repeated": 0, "id": 1989 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7272ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000470" } ], "repeated": 0, "id": 1990 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc727fa51", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000482" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000486" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5232f8ea-49c7-4840-bfbb-66e785689e88}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1991 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc72022bf", "parentcaller": "0x7ffbc727fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{79AB57F6-43FE-487B-8A7F-99567200AE94}" }, { "name": "Handle", "value": "0x00000472" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{79AB57F6-43FE-487B-8A7F-99567200AE94}" } ], "repeated": 0, "id": 1992 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc727fa8c", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000486" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5232f8ea-49c7-4840-bfbb-66e785689e88}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1993 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc727fad3", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000486" } ], "repeated": 0, "id": 1994 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc727fae4", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000482" } ], "repeated": 0, "id": 1995 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc727fa51", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000472" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000466" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{79ab57f6-43fe-487b-8a7f-99567200ae94}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1996 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4caa000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1997 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc728dd9d", "parentcaller": "0x7ffbc7227428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000480" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000344" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.StateRepository.Package" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package" } ], "repeated": 0, "id": 1998 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc728ddf7", "parentcaller": "0x7ffbc7227428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000480" }, { "name": "KeyInformation", "value": "\\xfffci\\x0e\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00P\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00P\\x00a\\x00c\\x00k\\x00a\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EM\\xffc7\\xfffb\\x7f\\x00\\x00\\xfff8\\xff98\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffe7\\xff9f^D\\x00\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00\\xfff0\\xff99\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00\\xffb4\\x03\\xffac\\xffbcP\\xffe2\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffa7\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\xfff8\\xff98\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\xffd0\\xff98\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d!\\xffc7\\xfffb\\x7f\\x00\\x00\\xfff0\\xff99\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff98\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\xfff0\\xff99\\xffca\\xffe4\\xffbc\\x01\\x00\\x00P\\xffa7\\xffca\\xffe4\\xffbc\\x01\\x00\\x00 \\xffb8\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s!\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffa7\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\xffb0\\xff94\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\xffb0\\xff94\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xff99\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xff94\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00\\xfff0\\xff99\\xffca\\xffe4\\xffbc\\x01\\x00\\x00 \\xffb8\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffe8\\xff9f^D\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xff9d\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\xffd0\\xff98\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 1999 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc727fad3", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000466" } ], "repeated": 0, "id": 2000 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc727fae4", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000472" } ], "repeated": 0, "id": 2001 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2002 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2003 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000480" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivationType" } ], "repeated": 0, "id": 2004 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7b93f7a", "parentcaller": "0x7ffbc7020ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2005 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7020cd1", "parentcaller": "0x7ffbc701f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000470" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 2006 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc549026b", "parentcaller": "0x7ffbc7020daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000464" } ], "repeated": 0, "id": 2007 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7289cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000480" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\TrustLevel" } ], "repeated": 0, "id": 2008 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7b88cde", "parentcaller": "0x7ffbc7bc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xaby\t\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00jy\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2009 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x98\\xb1\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00I\\x00S\\x00T\\x00R\\x00Y\\x00\\\\x00U\\x00S\\x00E\\x00R\\x00\\\\x00S\\x00-\\x001\\x00-\\x005\\x00-\\x002\\x001\\x00-\\x003\\x009\\x006\\x008\\x006\\x008\\x00" } ], "repeated": 0, "id": 2010 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000480" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\CustomAttributes" } ], "repeated": 0, "id": 2011 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6f8f", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x18\\xea\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 2012 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc71e7deb", "parentcaller": "0x7ffbc7298ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000480" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\RemoteServer" } ], "repeated": 0, "id": 2013 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6e46", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x08\\xba\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x006\\x008\\x006\\x000\\x004\\x000\\x00-\\x003\\x002\\x001\\x000\\x002\\x007\\x009\\x004\\x006\\x003\\x00-\\x008\\x004\\x007\\x009\\x007\\x007\\x006\\x000\\x00" } ], "repeated": 0, "id": 2014 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7289cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000480" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateAsUser" } ], "repeated": 0, "id": 2015 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6f37", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2016 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7289cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000480" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2017 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7020e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000470" } ], "repeated": 0, "id": 2018 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7289cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000480" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2019 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7292222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000480" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Permissions" } ], "repeated": 0, "id": 2020 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7289cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000480" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2021 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7287226", "parentcaller": "0x7ffbc728ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000480" } ], "repeated": 0, "id": 2022 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc72022bf", "parentcaller": "0x7ffbc727fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{679C64B7-81AB-42C2-8819-C958767753F4}" }, { "name": "Handle", "value": "0x00000466" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{679C64B7-81AB-42C2-8819-C958767753F4}" } ], "repeated": 0, "id": 2023 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc727fa51", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000466" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000472" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{679C64B7-81AB-42C2-8819-C958767753F4}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2024 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc727fa8c", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000472" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{679C64B7-81AB-42C2-8819-C958767753F4}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2025 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc727fad3", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000472" } ], "repeated": 0, "id": 2026 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc727fae4", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000466" } ], "repeated": 0, "id": 2027 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2028 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2029 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7b93f7a", "parentcaller": "0x7ffbc7020ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2030 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7020cd1", "parentcaller": "0x7ffbc701f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000464" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 2031 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc549026b", "parentcaller": "0x7ffbc7020daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000470" } ], "repeated": 0, "id": 2032 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7b88cde", "parentcaller": "0x7ffbc7bc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xaby\t\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00jy\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2033 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6e46", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xd8\\xb2\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00_\\x00C\\x00l\\x00a\\x00s\\x00s\\x00e\\x00s\\x00\\\\x00C\\x00L\\x00\\x04\\x00\\\\x00R\\x00E\\x00G\\x00I\\x00S\\x00T\\x00R\\x00Y\\x00\\\\x00U\\x00S\\x00E\\x00R\\x00" } ], "repeated": 0, "id": 2034 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6e9b", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\xe9\\xc8\\xe4\\xbc\\x01\\x00\\x00`\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xfb\\x7f\\x00\\x000\\x002\\x00-\\x008\\x004\\x00e\\x000\\x00-\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x003\\x002\\x009\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\xc3\\xe4" } ], "repeated": 0, "id": 2035 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6ec0", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2036 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x18G\\xc7\\xe4\\xbc\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 2037 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6f37", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2038 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6f8f", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "x\\xe1\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 2039 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb7048", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00\\xda\\x10\\xf5u\r\\x8a\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00\\xd0\\xdb\\xdf^D\\x00\\x00\\x00\\xc8\\xdb\\xdf^D\\x00\\x00\\x00\\x98\\xdb\\xdf^D\\x00\\x00\\x00\\xb8\\xdb\\xdf^" } ], "repeated": 0, "id": 2040 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb707b", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe1\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xb8\\xd9\\xdf^D\\x00\\x00\\x00p\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 2041 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7b88cde", "parentcaller": "0x7ffbc7b8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xaby\t\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00jy\t\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2042 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6e46", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xf8\\xb0\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x007\\x006\\x00E\\x006\\x002\\x001\\x009\\x00D\\x003\\x003\\x004\\x001\\x00}\\x00\\\\x00I\\x00n\\x00P\\x00r\\x00o\\x00c\\x00S\\x00e\\x00r\\x00v\\x00e\\x00r\\x00" } ], "repeated": 0, "id": 2043 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6e9b", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xe0\\xe1\\xc8\\xe4\\xbc\\x01\\x00\\x00`\\x00\\x00\\x00r\\x00e\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00i\\x00e\\x00s\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00A\\x00p\\x00p\\x00P\\x00r\\x00i\\x00" } ], "repeated": 0, "id": 2044 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6ec0", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2045 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc7bb6f0e", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "(L\\xc7\\xe4\\xbc\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 2046 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc72022bf", "parentcaller": "0x7ffbc727fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{0450CE77-AF0D-40AC-93FD-1E5D48C89419}" }, { "name": "Handle", "value": "0x00000482" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{0450CE77-AF0D-40AC-93FD-1E5D48C89419}" } ], "repeated": 0, "id": 2047 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7020e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" } ], "repeated": 0, "id": 2048 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc727fa51", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000482" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000486" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0450ce77-af0d-40ac-93fd-1e5d48c89419}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2049 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000470" } ], "repeated": 0, "id": 2050 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc54508ee", "parentcaller": "0x7ffbc7298bd7", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000470" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "9452" } ], "repeated": 0, "id": 2051 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc549026b", "parentcaller": "0x7ffbc545cbb0", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000470" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000464" } ], "repeated": 0, "id": 2052 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc727fa8c", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000486" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0450ce77-af0d-40ac-93fd-1e5d48c89419}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2053 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc545aaa8", "parentcaller": "0x7ffbc545cb7c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x000V\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\xd0V\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0V\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x04X\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18X\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00 X\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@X\\xc9\\xe4\\xbc\\x01\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00HX\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00hX\\xc9\\xe4\\xbc\\x01\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00 W\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\xa6W\\xc9\\xe4\\xbc\\x01\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\xacW\\xc9\\xe4\\xbc\\x01\\x00\\x00" } ], "repeated": 0, "id": 2054 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc727fad3", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000486" } ], "repeated": 0, "id": 2055 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc545cbbe", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" } ], "repeated": 0, "id": 2056 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc549026b", "parentcaller": "0x7ffbc545cbb0", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000470" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000464" } ], "repeated": 0, "id": 2057 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc727fae4", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000482" } ], "repeated": 0, "id": 2058 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc545aa1f", "parentcaller": "0x7ffbc545cb7c", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2059 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x000V\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\xd0V\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0V\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x04X\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18X\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00 X\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@X\\xc9\\xe4\\xbc\\x01\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00HX\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00hX\\xc9\\xe4\\xbc\\x01\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00 W\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\xa6W\\xc9\\xe4\\xbc\\x01\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\xacW\\xc9\\xe4\\xbc\\x01\\x00\\x00" } ], "repeated": 0, "id": 2060 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9880", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbb0929183", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000470" } ], "repeated": 0, "id": 2061 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc72022bf", "parentcaller": "0x7ffbc727fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{195F5943-0C04-4EAB-B907-735817FDAC77}" }, { "name": "Handle", "value": "0x0000048a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{195F5943-0C04-4EAB-B907-735817FDAC77}" } ], "repeated": 0, "id": 2062 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc727fa51", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000048a" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000048e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{195f5943-0c04-4eab-b907-735817fdac77}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2063 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc727fa8c", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{195f5943-0c04-4eab-b907-735817fdac77}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2064 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc727fad3", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048e" } ], "repeated": 0, "id": 2065 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc727fae4", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048a" } ], "repeated": 0, "id": 2066 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2067 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2068 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7c0e53f", "parentcaller": "0x7ffbc7b6faf7", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 2069 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b65157", "parentcaller": "0x7ffbc7b643ea", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "capauthz.dll" } ], "repeated": 0, "id": 2070 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7baf37b", "parentcaller": "0x7ffbc7baf207", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\capauthz.dll" } ], "repeated": 0, "id": 2071 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7bafc9c", "parentcaller": "0x7ffbc7bafa80", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000488" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\capauthz.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2072 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7bafcfe", "parentcaller": "0x7ffbc7bafa80", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000048c" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000488" }, { "name": "FileName", "value": "C:\\Windows\\System32\\capauthz.dll" } ], "repeated": 0, "id": 2073 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b64d42", "parentcaller": "0x7ffbc7b64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000048c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbbcf40000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00051000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2074 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b5fee4", "parentcaller": "0x7ffbc7b5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbbcf8a000" }, { "name": "ModuleName", "value": "capauthz.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2075 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b5ffb5", "parentcaller": "0x7ffbc7b5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbbcf78000" }, { "name": "ModuleName", "value": "capauthz.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2076 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b5ffed", "parentcaller": "0x7ffbc7b5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbbcf78000" }, { "name": "ModuleName", "value": "capauthz.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2077 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b60068", "parentcaller": "0x7ffbc7b5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbbcf78000" }, { "name": "ModuleName", "value": "capauthz.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2078 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b6009c", "parentcaller": "0x7ffbc7b5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbbcf78000" }, { "name": "ModuleName", "value": "capauthz.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2079 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b65082", "parentcaller": "0x7ffbc7b679d2", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbbcf78000" }, { "name": "ModuleName", "value": "capauthz.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2080 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4cab000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2081 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b65157", "parentcaller": "0x7ffbc7b643ea", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000490" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "WINTRUST.dll" } ], "repeated": 0, "id": 2082 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b64d42", "parentcaller": "0x7ffbc7b64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000490" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc5930000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00067000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2083 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b5fee4", "parentcaller": "0x7ffbc7b5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc5993000" }, { "name": "ModuleName", "value": "WINTRUST.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2084 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b5ffb5", "parentcaller": "0x7ffbc7b5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc597a000" }, { "name": "ModuleName", "value": "WINTRUST.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2085 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b5ffed", "parentcaller": "0x7ffbc7b5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc597a000" }, { "name": "ModuleName", "value": "WINTRUST.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2086 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b60068", "parentcaller": "0x7ffbc7b5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc597a000" }, { "name": "ModuleName", "value": "WINTRUST.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2087 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b6009c", "parentcaller": "0x7ffbc7b5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc597a000" }, { "name": "ModuleName", "value": "WINTRUST.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2088 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b65082", "parentcaller": "0x7ffbc7b679d2", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc597a000" }, { "name": "ModuleName", "value": "WINTRUST.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2089 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4cac000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2090 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b64485", "parentcaller": "0x7ffbc7b688a8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000490" } ], "repeated": 0, "id": 2091 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7bafd68", "parentcaller": "0x7ffbc7bafa80", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048c" } ], "repeated": 0, "id": 2092 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7bafd71", "parentcaller": "0x7ffbc7bafa80", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000488" } ], "repeated": 0, "id": 2093 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b97bac", "parentcaller": "0x7ffbc7b8288a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc597a000" }, { "name": "ModuleName", "value": "WINTRUST.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2094 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b97bac", "parentcaller": "0x7ffbc7b8288a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbbcf78000" }, { "name": "ModuleName", "value": "capauthz.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2095 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7b97bac", "parentcaller": "0x7ffbc7b8288a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\WINTRUST" }, { "name": "DllBase", "value": "0x7ffbc5930000" } ], "repeated": 0, "id": 2096 }, { "timestamp": "2026-05-28 23:34:30,983", "thread_id": "9840", "caller": "0x7ffbc7bb7cc6", "parentcaller": "0x7ffbc7b8ddf7", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 2, "id": 2097 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9840", "caller": "0x7ffbc7bb7cc6", "parentcaller": "0x7ffbc7b8ddf7", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\capauthz" }, { "name": "DllBase", "value": "0x7ffbbcf40000" } ], "repeated": 0, "id": 2098 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2099 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2100 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2101 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2102 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9880", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc728224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2103 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9880", "caller": "0x7ffbc7051630", "parentcaller": "0x7ffbc70512cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2104 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9880", "caller": "0x7ffbc72022bf", "parentcaller": "0x7ffbc727fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{F655B052-348B-4AB0-947B-A7DAFA44D404}" }, { "name": "Handle", "value": "0x00000472" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{F655B052-348B-4AB0-947B-A7DAFA44D404}" } ], "repeated": 0, "id": 2105 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9880", "caller": "0x7ffbc727fa51", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000472" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000466" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{F655B052-348B-4AB0-947B-A7DAFA44D404}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2106 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9880", "caller": "0x7ffbc727fa8c", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000466" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{F655B052-348B-4AB0-947B-A7DAFA44D404}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2107 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9880", "caller": "0x7ffbc727fad3", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000466" } ], "repeated": 0, "id": 2108 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9880", "caller": "0x7ffbc727fae4", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000472" } ], "repeated": 0, "id": 2109 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2110 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2111 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9840", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4d16000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2112 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9840", "caller": "0x7ffbc544ed78", "parentcaller": "0x7ffbc549cf77", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000480" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 2113 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9840", "caller": "0x7ffbc544ed78", "parentcaller": "0x7ffbc549cf77", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048c" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 2114 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9840", "caller": "0x7ffbc7b97830", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc5993000" }, { "name": "ModuleName", "value": "WINTRUST.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2115 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9840", "caller": "0x7ffbc7b97881", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc5993000" }, { "name": "ModuleName", "value": "WINTRUST.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2116 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9840", "caller": "0x7ffbc7c0e53f", "parentcaller": "0x7ffbc7b6faf7", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 2117 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9840", "caller": "0x7ffbc7b65157", "parentcaller": "0x7ffbc7b643ea", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "MSASN1.dll" } ], "repeated": 0, "id": 2118 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9840", "caller": "0x7ffbc7baf37b", "parentcaller": "0x7ffbc7baf207", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\MSASN1.dll" } ], "repeated": 0, "id": 2119 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9840", "caller": "0x7ffbc7baf37b", "parentcaller": "0x7ffbc7baf207", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\msasn1.dll" } ], "repeated": 0, "id": 2120 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9880", "caller": "0x7ffbc727fad3", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000466" } ], "repeated": 0, "id": 2121 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9880", "caller": "0x7ffbc727fae4", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000472" } ], "repeated": 0, "id": 2122 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9880", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2123 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9880", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2124 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9840", "caller": "0x7ffbc7bafc9c", "parentcaller": "0x7ffbc7baf7b0", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000498" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\msasn1.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2125 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9840", "caller": "0x7ffbc7bafcfe", "parentcaller": "0x7ffbc7baf7b0", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000049c" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000498" }, { "name": "FileName", "value": "C:\\Windows\\System32\\msasn1.dll" } ], "repeated": 0, "id": 2126 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9840", "caller": "0x7ffbc7b64d42", "parentcaller": "0x7ffbc7b64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000049c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc4d80000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00012000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2127 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9840", "caller": "0x7ffbc7b5ffb5", "parentcaller": "0x7ffbc7b5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc4d8a000" }, { "name": "ModuleName", "value": "MSASN1.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2128 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9840", "caller": "0x7ffbc7b5ffed", "parentcaller": "0x7ffbc7b5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc4d8a000" }, { "name": "ModuleName", "value": "MSASN1.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2129 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9840", "caller": "0x7ffbc7b60068", "parentcaller": "0x7ffbc7b5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc4d8a000" }, { "name": "ModuleName", "value": "MSASN1.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2130 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9840", "caller": "0x7ffbc7b6009c", "parentcaller": "0x7ffbc7b5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc4d8a000" }, { "name": "ModuleName", "value": "MSASN1.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2131 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9840", "caller": "0x7ffbc7b65082", "parentcaller": "0x7ffbc7b679d2", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc4d8a000" }, { "name": "ModuleName", "value": "MSASN1.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2132 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9840", "caller": "0x7ffbc7bafd68", "parentcaller": "0x7ffbc7baf7b0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049c" } ], "repeated": 0, "id": 2133 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9840", "caller": "0x7ffbc7bafd71", "parentcaller": "0x7ffbc7baf7b0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" } ], "repeated": 0, "id": 2134 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9840", "caller": "0x7ffbc7b97bac", "parentcaller": "0x7ffbc7b8288a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc4d8a000" }, { "name": "ModuleName", "value": "MSASN1.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2135 }, { "timestamp": "2026-05-28 23:34:30,999", "thread_id": "9840", "caller": "0x7ffbc7b97bac", "parentcaller": "0x7ffbc7b8288a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\MSASN1" }, { "name": "DllBase", "value": "0x7ffbc4d80000" } ], "repeated": 0, "id": 2136 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbc7bbc2c7", "parentcaller": "0x7ffbc7bbc05a", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\msasn1" }, { "name": "BaseAddress", "value": "0x7ffbc4d80000" }, { "name": "InitRoutine", "value": "0x7ffbc4d85860" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 2137 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbc7b97830", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc5993000" }, { "name": "ModuleName", "value": "WINTRUST.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2138 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbc7b97881", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc5993000" }, { "name": "ModuleName", "value": "WINTRUST.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2139 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbc4d857f9", "parentcaller": "0x7ffbc4d856a6", "category": "registry", "api": "RegOpenKeyExA", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\msasn1" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\msasn1" } ], "repeated": 0, "id": 2140 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbc4d857f9", "parentcaller": "0x7ffbc4d856a6", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\wintrust" }, { "name": "BaseAddress", "value": "0x7ffbc5930000" }, { "name": "InitRoutine", "value": "0x7ffbc5941670" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 2141 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbc7bbc2c7", "parentcaller": "0x7ffbc7bbc05a", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\capauthz" }, { "name": "BaseAddress", "value": "0x7ffbbcf40000" }, { "name": "InitRoutine", "value": "0x7ffbbcf72fd0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 2142 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbc7b97830", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbb507f000" }, { "name": "ModuleName", "value": "execmodelclient.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2143 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbc7b97881", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbb507f000" }, { "name": "ModuleName", "value": "execmodelclient.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2144 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9880", "caller": "0x7ffbc727fa51", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000049e" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x000004a2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2145 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9880", "caller": "0x7ffbc727fa8c", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2146 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9880", "caller": "0x7ffbc727fad3", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a2" } ], "repeated": 0, "id": 2147 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9880", "caller": "0x7ffbc727fae4", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049e" } ], "repeated": 0, "id": 2148 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2149 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2150 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbbcf468cd", "parentcaller": "0x7ffbbcf44292", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\SecurityManager\\CapAuthz" }, { "name": "Handle", "value": "0x0000049c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz" } ], "repeated": 0, "id": 2151 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbbcf46915", "parentcaller": "0x7ffbbcf44292", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\SecurityManager\\CapAuthz\\HasRepaired" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x0000000e", "pretty_value": "KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS" }, { "name": "Handle", "value": "0x000004a0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\HasRepaired" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 2152 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbbcf4695a", "parentcaller": "0x7ffbbcf44292", "category": "registry", "api": "RegCreateKeyExW", "status": false, "return": "0x000003fd", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\SecurityManager\\CapAuthz\\HasRepaired\\VolatileChildTest" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00000002", "pretty_value": "KEY_SET_VALUE" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\HasRepaired\\VolatileChildTest" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 2153 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbbcf46b50", "parentcaller": "0x7ffbbcf44292", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049c" } ], "repeated": 0, "id": 2154 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbbcf46b7a", "parentcaller": "0x7ffbbcf44292", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a0" } ], "repeated": 0, "id": 2155 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbbcf46ec9", "parentcaller": "0x7ffbbcf4b441", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\SecurityManager\\CapDBRedirect" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapDBRedirect" } ], "repeated": 0, "id": 2156 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbbcf4b576", "parentcaller": "0x7ffbbcf442f2", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe" }, { "name": "Handle", "value": "0x000004a0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe" } ], "repeated": 0, "id": 2157 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbbcf48f48", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a0" }, { "name": "ValueName", "value": "AppPackageType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType" } ], "repeated": 0, "id": 2158 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbbcf48fc0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a0" }, { "name": "ValueName", "value": "AppPackageType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType" } ], "repeated": 0, "id": 2159 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbbcf48f48", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a0" }, { "name": "ValueName", "value": "PackageSid" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid" } ], "repeated": 0, "id": 2160 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbbcf48fc0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a0" }, { "name": "ValueName", "value": "PackageSid" }, { "name": "Data", "value": "S-1-15-2-543634040-274359014-2226501544-3561766748-3991453649-3543631192-522786984" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid" } ], "repeated": 0, "id": 2161 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbbcf48f48", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a0" }, { "name": "ValueName", "value": "CapSids" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids" } ], "repeated": 0, "id": 2162 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbbcf48fc0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a0" }, { "name": "ValueName", "value": "CapSids" }, { "name": "Data", "value": "\\x03\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x93MhQ\\x18=\\xc3\\xa6(\\x927f\\xc7\\xb1\\xfd\\x1eb\\x11\\xb0\\x8dT\\xad@A8\\xb7l\\xebv\\xc0V\\xd6\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xdc\\xdc\\xc7+\\x1b\\x84\\xfb\\x17\\x8c\\xfd\\xd5\\x99\\x9fj\\xa1T\\xc3\t\\x1a\\xfbT\\xa8\\x98\\xa2\\x98\\xef\\x9b\r\\xe1=\\xaa!\\x01\\x08\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00x2g \\xe6bZ\\x10\\xa8\\xb7\\xb5\\x84\\?L\\xd4\\xd1\\xbf\\xe8\\xedX\\x857\\xd3\\xa8\\x18)\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids" } ], "repeated": 0, "id": 2163 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbbcf48f48", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a0" }, { "name": "ValueName", "value": "ApplicationFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags" } ], "repeated": 0, "id": 2164 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbbcf48fc0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a0" }, { "name": "ValueName", "value": "ApplicationFlags" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags" } ], "repeated": 0, "id": 2165 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbbcf4bca8", "parentcaller": "0x7ffbbcf442f2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000002" } ], "repeated": 0, "id": 2166 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbbcf4bcde", "parentcaller": "0x7ffbbcf442f2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a0" } ], "repeated": 0, "id": 2167 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbc549026b", "parentcaller": "0x7ffbb5029bfa", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000004a0" } ], "repeated": 0, "id": 2168 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbb5029c3b", "parentcaller": "0x7ffbb504d3e7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xf3\\x9f^D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xf4\\x9f^D\\x00\\x00\\x00" } ], "repeated": 0, "id": 2169 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbb5029cb3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a0" } ], "repeated": 0, "id": 2170 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbbf3371e2", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps" }, { "name": "Handle", "value": "0x00000110" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps" } ], "repeated": 0, "id": 2171 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbbf33723c", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\PolicyType" } ], "repeated": 0, "id": 2172 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbbf3372a8", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "139296" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Behavior" } ], "repeated": 0, "id": 2173 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbbf33732c", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\MergeAlgorithm" } ], "repeated": 0, "id": 2174 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbbf33739f", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 2175 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbbf337402", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirect" } ], "repeated": 0, "id": 2176 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbbf33755e", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyname" } ], "repeated": 0, "id": 2177 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbbf3375df", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "Data", "value": "LetAppsRunInBackground_UserInControlOfTheseApps" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyname" } ], "repeated": 0, "id": 2178 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbbf337647", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath" } ], "repeated": 0, "id": 2179 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbbf33776a", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath" } ], "repeated": 0, "id": 2180 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbbf3377f6", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicyismultisz" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyismultisz" } ], "repeated": 0, "id": 2181 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbbf337836", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicymultiszSeparatorChar" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicymultiszSeparatorChar" } ], "repeated": 0, "id": 2182 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbbf3378f6", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataUser" } ], "repeated": 0, "id": 2183 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbbf3379b1", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataDevice" } ], "repeated": 0, "id": 2184 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbbf337a6c", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataBoth" } ], "repeated": 0, "id": 2185 }, { "timestamp": "2026-05-28 23:34:31,014", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbbf33db1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\30Value" } ], "repeated": 0, "id": 2186 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf337ca8", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Value" } ], "repeated": 0, "id": 2187 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf3376a9", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" } ], "repeated": 0, "id": 2188 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf335c61", "parentcaller": "0x7ffbbf335ac0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } ], "repeated": 0, "id": 2189 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf335d7c", "parentcaller": "0x7ffbbf335ac0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" } ], "repeated": 0, "id": 2190 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf3371e2", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps" }, { "name": "Handle", "value": "0x00000110" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps" } ], "repeated": 0, "id": 2191 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf33723c", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\PolicyType" } ], "repeated": 0, "id": 2192 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf3372a8", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "139296" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Behavior" } ], "repeated": 0, "id": 2193 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf33732c", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\MergeAlgorithm" } ], "repeated": 0, "id": 2194 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf33739f", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 2195 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf337402", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirect" } ], "repeated": 0, "id": 2196 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf33755e", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname" } ], "repeated": 0, "id": 2197 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf3375df", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "Data", "value": "LetAppsRunInBackground_ForceAllowTheseApps" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname" } ], "repeated": 0, "id": 2198 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf337647", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath" } ], "repeated": 0, "id": 2199 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf33776a", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath" } ], "repeated": 0, "id": 2200 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf3377f6", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicyismultisz" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyismultisz" } ], "repeated": 0, "id": 2201 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf337836", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicymultiszSeparatorChar" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicymultiszSeparatorChar" } ], "repeated": 0, "id": 2202 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf3378f6", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataUser" } ], "repeated": 0, "id": 2203 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf3379b1", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataDevice" } ], "repeated": 0, "id": 2204 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf337a6c", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataBoth" } ], "repeated": 0, "id": 2205 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbbf33db1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\30Value" } ], "repeated": 0, "id": 2206 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf337ca8", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Value" } ], "repeated": 0, "id": 2207 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf3376a9", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" } ], "repeated": 0, "id": 2208 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf335c61", "parentcaller": "0x7ffbbf335ac0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } ], "repeated": 0, "id": 2209 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf335d7c", "parentcaller": "0x7ffbbf335ac0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" } ], "repeated": 0, "id": 2210 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf3371e2", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps" }, { "name": "Handle", "value": "0x00000110" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps" } ], "repeated": 0, "id": 2211 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf33723c", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\PolicyType" } ], "repeated": 0, "id": 2212 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf3372a8", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "139296" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Behavior" } ], "repeated": 0, "id": 2213 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf33732c", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\MergeAlgorithm" } ], "repeated": 0, "id": 2214 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf33739f", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 2215 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf337402", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirect" } ], "repeated": 0, "id": 2216 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf33755e", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname" } ], "repeated": 0, "id": 2217 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf3375df", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "Data", "value": "LetAppsRunInBackground_ForceDenyTheseApps" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname" } ], "repeated": 0, "id": 2218 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf337647", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicypath" } ], "repeated": 0, "id": 2219 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf33776a", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicypath" } ], "repeated": 0, "id": 2220 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf3377f6", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicyismultisz" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyismultisz" } ], "repeated": 0, "id": 2221 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf337836", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicymultiszSeparatorChar" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicymultiszSeparatorChar" } ], "repeated": 0, "id": 2222 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf3378f6", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataUser" } ], "repeated": 0, "id": 2223 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf3379b1", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataDevice" } ], "repeated": 0, "id": 2224 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf337a6c", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataBoth" } ], "repeated": 0, "id": 2225 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbbf33db1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\30Value" } ], "repeated": 0, "id": 2226 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Value" } ], "repeated": 0, "id": 2227 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf3376a9", "parentcaller": "0x7ffbbf335a59", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" } ], "repeated": 0, "id": 2228 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf335c61", "parentcaller": "0x7ffbbf335ac0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } ], "repeated": 0, "id": 2229 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9880", "caller": "0x7ffbc72022bf", "parentcaller": "0x7ffbc727fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{2A1821FE-179D-49BC-B79D-A527920D3665}" }, { "name": "Handle", "value": "0x00000472" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{2A1821FE-179D-49BC-B79D-A527920D3665}" } ], "repeated": 0, "id": 2230 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf3371e2", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground" }, { "name": "Handle", "value": "0x00000110" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground" } ], "repeated": 0, "id": 2231 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9880", "caller": "0x7ffbc727fa51", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000472" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000466" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2A1821FE-179D-49BC-B79D-A527920D3665}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2232 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf3372a8", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "139296" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Behavior" } ], "repeated": 0, "id": 2233 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9880", "caller": "0x7ffbc727fa8c", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000466" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2A1821FE-179D-49BC-B79D-A527920D3665}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2234 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf33732c", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\MergeAlgorithm" } ], "repeated": 0, "id": 2235 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9880", "caller": "0x7ffbc727fad3", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000466" } ], "repeated": 0, "id": 2236 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf33739f", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 2237 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2238 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2239 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf337402", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirect" } ], "repeated": 0, "id": 2240 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf33755e", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname" } ], "repeated": 0, "id": 2241 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9880", "caller": "0x7ffbc7bb6e9b", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": " \\xe7\\xc8\\xe4\\xbc\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00F\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2242 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9880", "caller": "0x7ffbc7bb6ec0", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2243 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9880", "caller": "0x7ffbc7bb6f0e", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x98K\\xc7\\xe4\\xbc\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 2244 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9880", "caller": "0x7ffbc7bb6f37", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2245 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf3375df", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "Data", "value": "LetAppsRunInBackground" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname" } ], "repeated": 0, "id": 2246 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9880", "caller": "0x7ffbc7bb6f8f", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd8\\xe1\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 2247 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf337647", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath" } ], "repeated": 0, "id": 2248 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9880", "caller": "0x7ffbc7bb6e46", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xd8\\xb2\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00w\\x00s\\x00\\\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00M\\x00S\\x00A\\x00S\\x00N\\x001\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2249 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9880", "caller": "0x7ffbc7bb6e9b", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xc0\\xe3\\xc8\\xe4\\xbc\\x01\\x00\\x00`\\x00\\x00\\x00r\\x00e\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00i\\x00e\\x00s\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00A\\x00p\\x00p\\x00P\\x00r\\x00i\\x00" } ], "repeated": 0, "id": 2250 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9880", "caller": "0x7ffbc7bb6ec0", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2251 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9880", "caller": "0x7ffbc7bb6f0e", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xa8G\\xc7\\xe4\\xbc\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 2252 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf33776a", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath" } ], "repeated": 0, "id": 2253 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9880", "caller": "0x7ffbc7bb6f37", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2254 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf3377f6", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicyismultisz" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyismultisz" } ], "repeated": 0, "id": 2255 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9880", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7020e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" } ], "repeated": 0, "id": 2256 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf337836", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicymultiszSeparatorChar" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicymultiszSeparatorChar" } ], "repeated": 0, "id": 2257 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf3378f6", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataUser" } ], "repeated": 0, "id": 2258 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf3379b1", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataDevice" } ], "repeated": 0, "id": 2259 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf337a6c", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataBoth" } ], "repeated": 0, "id": 2260 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbbf33db1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\30Value" } ], "repeated": 0, "id": 2261 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9880", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7272ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" } ], "repeated": 0, "id": 2262 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf337b73", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "Value" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Value" } ], "repeated": 0, "id": 2263 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf3376a9", "parentcaller": "0x7ffbbf336abb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" } ], "repeated": 0, "id": 2264 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf336e85", "parentcaller": "0x7ffbbf336097", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } ], "repeated": 0, "id": 2265 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbf336d68", "parentcaller": "0x7ffbbf336097", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" } ], "repeated": 0, "id": 2266 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbcf46ec9", "parentcaller": "0x7ffbbcf4b441", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\SecurityManager\\CapDBRedirect" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapDBRedirect" } ], "repeated": 0, "id": 2267 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbcf4b576", "parentcaller": "0x7ffbbcf442f2", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe" }, { "name": "Handle", "value": "0x00000110" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe" } ], "repeated": 0, "id": 2268 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbbcf48f48", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "AppPackageType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType" } ], "repeated": 0, "id": 2269 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbbcf48fc0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "AppPackageType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType" } ], "repeated": 0, "id": 2270 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbbcf48f48", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "PackageSid" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid" } ], "repeated": 0, "id": 2271 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "shcore.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5c20000" }, { "name": "FunctionName", "value": "CommandLineToArgvW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc5c3eb30" } ], "repeated": 0, "id": 2272 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbbcf48fc0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "PackageSid" }, { "name": "Data", "value": "S-1-15-2-543634040-274359014-2226501544-3561766748-3991453649-3543631192-522786984" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid" } ], "repeated": 0, "id": 2273 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbbcf48f48", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "CapSids" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids" } ], "repeated": 0, "id": 2274 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbbcf48fc0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "CapSids" }, { "name": "Data", "value": "\\x03\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x93MhQ\\x18=\\xc3\\xa6(\\x927f\\xc7\\xb1\\xfd\\x1eb\\x11\\xb0\\x8dT\\xad@A8\\xb7l\\xebv\\xc0V\\xd6\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xdc\\xdc\\xc7+\\x1b\\x84\\xfb\\x17\\x8c\\xfd\\xd5\\x99\\x9fj\\xa1T\\xc3\t\\x1a\\xfbT\\xa8\\x98\\xa2\\x98\\xef\\x9b\r\\xe1=\\xaa!\\x01\\x08\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00x2g \\xe6bZ\\x10\\xa8\\xb7\\xb5\\x84\\?L\\xd4\\xd1\\xbf\\xe8\\xedX\\x857\\xd3\\xa8\\x18)\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids" } ], "repeated": 0, "id": 2275 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbbcf48f48", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "ApplicationFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags" } ], "repeated": 0, "id": 2276 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000434" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00L\\x00i\\x00m\\x00i\\x00t\\x00e\\x00d\\x00A\\x00c\\x00c\\x00e\\x00s\\x00s\\x00F\\x00e\\x00a\\x00t\\x00u\\x00r\\x00e\\x00s\\x00 \\x00\\x00\\x00\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EM\\xffc7\\xfffb\\x7f\\x00\\x00\\xfff8\\xff96\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffc3r]D\\x00\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00\\xffd0\\xff94\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00d&A\\xffbfP\\xffe2\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffa7\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\xfff8\\xff96\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\xffd0\\xff96\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d!\\xffc7\\xfffb\\x7f\\x00\\x00\\xffd0\\xff94\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff96\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\xffd0\\xff94\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00P\\xffa7\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\xffa0\\xffb0\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s!\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffa7\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\xfff0\\xff99\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\xfff0\\xff99\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff94\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xff99\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00\\xffd0\\xff94\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\xffa0\\xffb0\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffc4r]D\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xff96\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\xffd0\\xff96\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2277 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbbcf48fc0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "ApplicationFlags" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags" } ], "repeated": 0, "id": 2278 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbcf4bca8", "parentcaller": "0x7ffbbcf442f2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000002" } ], "repeated": 0, "id": 2279 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbbcf4bcde", "parentcaller": "0x7ffbbcf442f2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" } ], "repeated": 0, "id": 2280 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc54326e8", "parentcaller": "0x7ffbc543132e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xf0\\x9f^D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00g\\xe6\tj\\x01\\x00\\x00\\x00r\\xf3n<:\\xf5O\\xa5\\x7fR\\x0eQ" } ], "repeated": 0, "id": 2281 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc545df8a", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7ffbc7b50000" } ], "repeated": 0, "id": 2282 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc545df8a", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc7b50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2283 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbc545dfa1", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bc8560" } ], "repeated": 0, "id": 2284 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc5453a9c", "parentcaller": "0x7ffbc5453529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2285 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc5453f76", "parentcaller": "0x7ffbc54d46a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000110" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 2286 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc5453b20", "parentcaller": "0x7ffbc5453529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2287 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc5453f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000110" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2288 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc5453f76", "parentcaller": "0x7ffbc54d4fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a0" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000110" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Appx" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Appx" } ], "repeated": 0, "id": 2289 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc545db13", "parentcaller": "0x7ffbc545da55", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a0" }, { "name": "ValueName", "value": "PackageRepositoryRoot" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot" } ], "repeated": 0, "id": 2290 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc545db13", "parentcaller": "0x7ffbc545da55", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a0" }, { "name": "ValueName", "value": "PackageRepositoryRoot" }, { "name": "Data", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot" } ], "repeated": 0, "id": 2291 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a0" } ], "repeated": 0, "id": 2292 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc5453a9c", "parentcaller": "0x7ffbc5453529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2293 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc5453f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000110" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2294 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc5453f76", "parentcaller": "0x7ffbc54d4fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a0" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000110" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Appx" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Appx" } ], "repeated": 0, "id": 2295 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\Windows.ApplicationModel.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\DllPath" } ], "repeated": 0, "id": 2296 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc545db13", "parentcaller": "0x7ffbc545da55", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a0" }, { "name": "ValueName", "value": "PackageRepositoryRoot" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot" } ], "repeated": 0, "id": 2297 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc545db13", "parentcaller": "0x7ffbc545da55", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a0" }, { "name": "ValueName", "value": "PackageRepositoryRoot" }, { "name": "Data", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot" } ], "repeated": 0, "id": 2298 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc545d70a", "parentcaller": "0x7ffbc5438db6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a0" } ], "repeated": 0, "id": 2299 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4cad000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2300 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\Threading" } ], "repeated": 0, "id": 2301 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\TrustLevel" } ], "repeated": 0, "id": 2302 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000004a0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2303 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000434" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\RemoteServer" } ], "repeated": 0, "id": 2304 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc5433d26", "parentcaller": "0x7ffbc5433354", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000049c" }, { "name": "DesiredAccess", "value": "0x00000004", "pretty_value": "SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000004a0" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" } ], "repeated": 0, "id": 2305 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc5433d37", "parentcaller": "0x7ffbc5433354", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a0" } ], "repeated": 0, "id": 2306 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc5433d8e", "parentcaller": "0x7ffbc5433354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000049c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce95d0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2307 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000434" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2308 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000434" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\Permissions" } ], "repeated": 0, "id": 2309 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9840", "caller": "0x7ffbc548ebae", "parentcaller": "0x7ffbc5c3712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x8f]D\\x00\\x00\\x00\\xec$\\x00\\x00\\x00\\x00\\x00\\x00p&\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9840" } ], "repeated": 0, "id": 2310 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000434" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2311 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" } ], "repeated": 0, "id": 2312 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.ApplicationModel" }, { "name": "DllBase", "value": "0x7ffbb3900000" } ], "repeated": 0, "id": 2313 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\Windows.ApplicationModel.dll" }, { "name": "BaseAddress", "value": "0x7ffbb3900000" } ], "repeated": 0, "id": 2314 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbb3900000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\Windows.ApplicationModel.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 2315 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "Windows.ApplicationModel.dll" }, { "name": "ModuleHandle", "value": "0x7ffbb3900000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbb390fa40" } ], "repeated": 0, "id": 2316 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "Windows.ApplicationModel.dll" }, { "name": "ModuleHandle", "value": "0x7ffbb3900000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbb390e870" } ], "repeated": 0, "id": 2317 }, { "timestamp": "2026-05-28 23:34:31,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "Windows.ApplicationModel.dll" }, { "name": "ModuleHandle", "value": "0x7ffbb3900000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbb390f430" } ], "repeated": 0, "id": 2318 }, { "timestamp": "2026-05-28 23:34:31,045", "thread_id": "9616", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "__notification__", "api": "__anomaly__", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadIdentifier", "value": "9616" }, { "name": "Subcategory", "value": "unhook" }, { "name": "FunctionName", "value": "CommandLineToArgvW" }, { "name": "FunctionAddress", "value": "0x7ffbc5c3eb30" }, { "name": "UnhookType", "value": "restored" } ], "repeated": 0, "id": 2319 }, { "timestamp": "2026-05-28 23:34:31,045", "thread_id": "9880", "caller": "0x7ffbb093b596", "parentcaller": "0x7ffbc7b938c0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2320 }, { "timestamp": "2026-05-28 23:34:31,045", "thread_id": "9880", "caller": "0x7ffbc54508ee", "parentcaller": "0x7ffbb093b5d6", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000470" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "9452" } ], "repeated": 0, "id": 2321 }, { "timestamp": "2026-05-28 23:34:31,045", "thread_id": "9880", "caller": "0x7ffbc549026b", "parentcaller": "0x7ffbb093b5f6", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000470" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000474" } ], "repeated": 0, "id": 2322 }, { "timestamp": "2026-05-28 23:34:31,045", "thread_id": "9880", "caller": "0x7ffbc54554eb", "parentcaller": "0x7ffbb093b625", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2323 }, { "timestamp": "2026-05-28 23:34:31,045", "thread_id": "9880", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbb093b635", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000474" } ], "repeated": 0, "id": 2324 }, { "timestamp": "2026-05-28 23:34:31,045", "thread_id": "9880", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbb093b644", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000470" } ], "repeated": 0, "id": 2325 }, { "timestamp": "2026-05-28 23:34:31,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbb39df000" }, { "name": "ModuleName", "value": "Windows.ApplicationModel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2326 }, { "timestamp": "2026-05-28 23:34:31,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbb39df000" }, { "name": "ModuleName", "value": "Windows.ApplicationModel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2327 }, { "timestamp": "2026-05-28 23:34:31,061", "thread_id": "9880", "caller": "0x7ffbc548ebae", "parentcaller": "0x7ffbc5c35b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x8f]D\\x00\\x00\\x00\\xec$\\x00\\x00\\x00\\x00\\x00\\x00\\x98&\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9880" } ], "repeated": 0, "id": 2328 }, { "timestamp": "2026-05-28 23:34:31,061", "thread_id": "9880", "caller": "0x7ffbc7b97830", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbb0a1a000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2329 }, { "timestamp": "2026-05-28 23:34:31,061", "thread_id": "9840", "caller": "0x7ffbc7b97830", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc5cc7000" }, { "name": "ModuleName", "value": "shcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2330 }, { "timestamp": "2026-05-28 23:34:31,061", "thread_id": "9840", "caller": "0x7ffbc7b97881", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc5cc7000" }, { "name": "ModuleName", "value": "shcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2331 }, { "timestamp": "2026-05-28 23:34:31,061", "thread_id": "9840", "caller": "0x7ffbc548ebae", "parentcaller": "0x7ffbc5c684de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x8f]D\\x00\\x00\\x00\\xec$\\x00\\x00\\x00\\x00\\x00\\x00p&\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9840" } ], "repeated": 0, "id": 2332 }, { "timestamp": "2026-05-28 23:34:31,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbb39df000" }, { "name": "ModuleName", "value": "Windows.ApplicationModel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2333 }, { "timestamp": "2026-05-28 23:34:31,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbb39df000" }, { "name": "ModuleName", "value": "Windows.ApplicationModel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2334 }, { "timestamp": "2026-05-28 23:34:31,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" } ], "repeated": 0, "id": 2335 }, { "timestamp": "2026-05-28 23:34:31,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000434" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\KERNELBASE.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2336 }, { "timestamp": "2026-05-28 23:34:31,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000464" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000434" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\KernelBase.dll.mui" } ], "repeated": 0, "id": 2337 }, { "timestamp": "2026-05-28 23:34:31,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000464" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce9c10000" }, { "name": "SectionOffset", "value": "0x445d72a7a0" }, { "name": "ViewSize", "value": "0x00140000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2338 }, { "timestamp": "2026-05-28 23:34:31,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" } ], "repeated": 0, "id": 2339 }, { "timestamp": "2026-05-28 23:34:31,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2340 }, { "timestamp": "2026-05-28 23:34:31,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2341 }, { "timestamp": "2026-05-28 23:34:31,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000001ac" }, { "name": "HandleName", "value": "\\Device\\KsecDD" }, { "name": "IoControlCode", "value": "0x00390400" }, { "name": "InputBuffer", "value": "M<+\\x1a\\x00\\x00\\x02\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00M\\x00D\\x005\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x005\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffM\\x00D\\x005\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00P\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00 \\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00c\\x00r\\x00y\\x00p\\x00t\\x00p\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00s\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2342 }, { "timestamp": "2026-05-28 23:34:31,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\bcryptprimitives.dll" }, { "name": "BaseAddress", "value": "0x7ffbc5750000" } ], "repeated": 0, "id": 2343 }, { "timestamp": "2026-05-28 23:34:31,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc5750000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\system32\\bcryptprimitives.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 2344 }, { "timestamp": "2026-05-28 23:34:31,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "bcryptprimitives.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5750000" }, { "name": "FunctionName", "value": "GetHashInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc5764460" } ], "repeated": 0, "id": 2345 }, { "timestamp": "2026-05-28 23:34:31,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2346 }, { "timestamp": "2026-05-28 23:34:31,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2347 }, { "timestamp": "2026-05-28 23:34:31,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "31" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\xb7r]D\\x00\\x00\\x00x\\xb7r]D\\x00\\x00\\x00\\xd0\\x91\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00D\\x00\\x00\\x00\\xb1&\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xeb\\xbc\\x01\\x00\\x00(W\\xc9\\xe4\\xbc\\x01\\x00\\x00\\xa0\\xbdr]" } ], "repeated": 0, "id": 2348 }, { "timestamp": "2026-05-28 23:34:31,061", "thread_id": "9880", "caller": "0x7ffbc7b97830", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbb0a1a000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2349 }, { "timestamp": "2026-05-28 23:34:31,061", "thread_id": "9880", "caller": "0x7ffbc7b97881", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbb0a1a000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2350 }, { "timestamp": "2026-05-28 23:34:31,077", "thread_id": "9840", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2351 }, { "timestamp": "2026-05-28 23:34:31,077", "thread_id": "9840", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2352 }, { "timestamp": "2026-05-28 23:34:31,077", "thread_id": "9840", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2353 }, { "timestamp": "2026-05-28 23:34:31,077", "thread_id": "9840", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2354 }, { "timestamp": "2026-05-28 23:34:31,077", "thread_id": "9840", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c98000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2355 }, { "timestamp": "2026-05-28 23:34:31,077", "thread_id": "9840", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc728224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2356 }, { "timestamp": "2026-05-28 23:34:31,077", "thread_id": "9840", "caller": "0x7ffbc7051630", "parentcaller": "0x7ffbc70512cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2357 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" } ], "repeated": 0, "id": 2358 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7b593b0" } ], "repeated": 0, "id": 2359 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7befc40" } ], "repeated": 0, "id": 2360 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7b92460" } ], "repeated": 0, "id": 2361 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bcfa30" } ], "repeated": 0, "id": 2362 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bacbd0" } ], "repeated": 0, "id": 2363 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bb3410" } ], "repeated": 0, "id": 2364 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "MutexName", "value": "Local\\SM0:9452:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 2365 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2366 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2367 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000470" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2368 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2369 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2370 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 2371 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000470" } ], "repeated": 0, "id": 2372 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" } ], "repeated": 0, "id": 2373 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" } ], "repeated": 0, "id": 2374 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures" }, { "name": "Handle", "value": "0x000004a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures" } ], "repeated": 0, "id": 2375 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000004a4" }, { "name": "SubKey", "value": "com.microsoft.windows.taskbar.requestPinSecondaryTile" }, { "name": "Handle", "value": "0x000004a8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile" } ], "repeated": 0, "id": 2376 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 2377 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\(Default)" } ], "repeated": 0, "id": 2378 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "04c19204-10d9-450a-95c4-2910c8f72be3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\(Default)" } ], "repeated": 0, "id": 2379 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbb39df000" }, { "name": "ModuleName", "value": "Windows.ApplicationModel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2380 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbb39df000" }, { "name": "ModuleName", "value": "Windows.ApplicationModel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2381 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbb39df000" }, { "name": "ModuleName", "value": "Windows.ApplicationModel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2382 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbb39df000" }, { "name": "ModuleName", "value": "Windows.ApplicationModel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2383 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000344" }, { "name": "ObjectAttributesName", "value": "Windows.Security.Cryptography.CryptographicBuffer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer" } ], "repeated": 0, "id": 2384 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "KeyInformation", "value": "7_\\xffea\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00b\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00e\\x00c\\x00u\\x00r\\x00i\\x00t\\x00y\\x00.\\x00C\\x00r\\x00y\\x00p\\x00t\\x00o\\x00g\\x00r\\x00a\\x00p\\x00h\\x00y\\x00.\\x00C\\x00r\\x00y\\x00p\\x00t\\x00o\\x00g\\x00r\\x00a\\x00p\\x00h\\x00i\\x00c\\x00B\\x00u\\x00f\\x00f\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EM\\xffc7\\xfffb\\x7f\\x00\\x00x\\xff95\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xffber]D\\x00\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00pl\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00$]A\\xffbfP\\xffe2\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffa2\\xffca\\xffe4\\xffbc\\x01\\x00\\x00x\\xff95\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00P\\xff95\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d!\\xffc7\\xfffb\\x7f\\x00\\x00pl\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff95\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00pl\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00P\\xffa2\\xffca\\xffe4\\xffbc\\x01\\x00\\x00P\\xffb0\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s!\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffa2\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\xff80\\xffb9\\xffc7\\xffe4\\xffbc\\x01\\x00\\x00\\xff80\\xffb9\\xffc7\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00pl\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffb9\\xffc7\\xffe4\\xffbc\\x01\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00pl\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00P\\xffb0\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xffbfr]D\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff9a\\xffca\\xffe4\\xffbc\\x01\\x00\\x00P\\xff95\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2385 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivationType" } ], "repeated": 0, "id": 2386 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Server" } ], "repeated": 0, "id": 2387 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\CryptoWinRT.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\DllPath" } ], "repeated": 0, "id": 2388 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Threading" } ], "repeated": 0, "id": 2389 }, { "timestamp": "2026-05-28 23:34:31,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\TrustLevel" } ], "repeated": 0, "id": 2390 }, { "timestamp": "2026-05-28 23:34:31,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004a4" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\CustomAttributes" } ], "repeated": 0, "id": 2391 }, { "timestamp": "2026-05-28 23:34:31,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\RemoteServer" } ], "repeated": 0, "id": 2392 }, { "timestamp": "2026-05-28 23:34:31,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateAsUser" } ], "repeated": 0, "id": 2393 }, { "timestamp": "2026-05-28 23:34:31,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2394 }, { "timestamp": "2026-05-28 23:34:31,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2395 }, { "timestamp": "2026-05-28 23:34:31,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Permissions" } ], "repeated": 0, "id": 2396 }, { "timestamp": "2026-05-28 23:34:31,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2397 }, { "timestamp": "2026-05-28 23:34:31,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 2398 }, { "timestamp": "2026-05-28 23:34:31,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\CryptoWinRT" }, { "name": "DllBase", "value": "0x7ffb888b0000" } ], "repeated": 0, "id": 2399 }, { "timestamp": "2026-05-28 23:34:31,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\CryptoWinRT.dll" }, { "name": "BaseAddress", "value": "0x7ffb888b0000" } ], "repeated": 0, "id": 2400 }, { "timestamp": "2026-05-28 23:34:31,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffb888b0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\CryptoWinRT.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 2401 }, { "timestamp": "2026-05-28 23:34:31,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "CryptoWinRT.dll" }, { "name": "ModuleHandle", "value": "0x7ffb888b0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffb888bf560" } ], "repeated": 0, "id": 2402 }, { "timestamp": "2026-05-28 23:34:31,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "CryptoWinRT.dll" }, { "name": "ModuleHandle", "value": "0x7ffb888b0000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffb888b8590" } ], "repeated": 0, "id": 2403 }, { "timestamp": "2026-05-28 23:34:31,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "CryptoWinRT.dll" }, { "name": "ModuleHandle", "value": "0x7ffb888b0000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffb888b5cd0" } ], "repeated": 0, "id": 2404 }, { "timestamp": "2026-05-28 23:34:31,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004b0" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000344" }, { "name": "ObjectAttributesName", "value": "Windows.Security.Cryptography.Core.HashAlgorithmNames" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames" } ], "repeated": 0, "id": 2405 }, { "timestamp": "2026-05-28 23:34:31,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004b0" }, { "name": "KeyInformation", "value": "7_\\xffea\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00j\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00e\\x00c\\x00u\\x00r\\x00i\\x00t\\x00y\\x00.\\x00C\\x00r\\x00y\\x00p\\x00t\\x00o\\x00g\\x00r\\x00a\\x00p\\x00h\\x00y\\x00.\\x00C\\x00o\\x00r\\x00e\\x00.\\x00H\\x00a\\x00s\\x00h\\x00A\\x00l\\x00g\\x00o\\x00r\\x00i\\x00t\\x00h\\x00m\\x00N\\x00a\\x00m\\x00e\\x00s\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EM\\xffc7\\xfffb\\x7f\\x00\\x00x\\xff90\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xffber]D\\x00\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00 e\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x004]A\\xffbfP\\xffe2\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffa8\\xffca\\xffe4\\xffbc\\x01\\x00\\x00x\\xff90\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00P\\xff90\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d!\\xffc7\\xfffb\\x7f\\x00\\x00 e\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff90\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00 e\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\xffd0\\xffa8\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\xffa0\\xffb5\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s!\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffa8\\xffca\\xffe4\\xffbc\\x01\\x00\\x000\\xffb8\\xffc7\\xffe4\\xffbc\\x01\\x00\\x000\\xffb8\\xffc7\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 e\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffb8\\xffc7\\xffe4\\xffbc\\x01\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00 e\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\xffa0\\xffb5\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xffbfr]D\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffb0\\xffc7\\xffe4\\xffbc\\x01\\x00\\x00P\\xff90\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2406 }, { "timestamp": "2026-05-28 23:34:31,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b0" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivationType" } ], "repeated": 0, "id": 2407 }, { "timestamp": "2026-05-28 23:34:31,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004b0" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Server" } ], "repeated": 0, "id": 2408 }, { "timestamp": "2026-05-28 23:34:31,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b0" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\CryptoWinRT.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\DllPath" } ], "repeated": 0, "id": 2409 }, { "timestamp": "2026-05-28 23:34:31,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b0" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Threading" } ], "repeated": 0, "id": 2410 }, { "timestamp": "2026-05-28 23:34:31,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b0" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\TrustLevel" } ], "repeated": 0, "id": 2411 }, { "timestamp": "2026-05-28 23:34:31,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004b0" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\CustomAttributes" } ], "repeated": 0, "id": 2412 }, { "timestamp": "2026-05-28 23:34:31,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004b0" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\RemoteServer" } ], "repeated": 0, "id": 2413 }, { "timestamp": "2026-05-28 23:34:31,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004b0" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateAsUser" } ], "repeated": 0, "id": 2414 }, { "timestamp": "2026-05-28 23:34:31,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004b0" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2415 }, { "timestamp": "2026-05-28 23:34:31,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004b0" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2416 }, { "timestamp": "2026-05-28 23:34:31,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004b0" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Permissions" } ], "repeated": 0, "id": 2417 }, { "timestamp": "2026-05-28 23:34:31,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004b0" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2418 }, { "timestamp": "2026-05-28 23:34:31,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b0" } ], "repeated": 0, "id": 2419 }, { "timestamp": "2026-05-28 23:34:31,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004b0" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000344" }, { "name": "ObjectAttributesName", "value": "Windows.Security.Cryptography.Core.HashAlgorithmProvider" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider" } ], "repeated": 0, "id": 2420 }, { "timestamp": "2026-05-28 23:34:31,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004b0" }, { "name": "KeyInformation", "value": "7_\\xffea\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00p\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00e\\x00c\\x00u\\x00r\\x00i\\x00t\\x00y\\x00.\\x00C\\x00r\\x00y\\x00p\\x00t\\x00o\\x00g\\x00r\\x00a\\x00p\\x00h\\x00y\\x00.\\x00C\\x00o\\x00r\\x00e\\x00.\\x00H\\x00a\\x00s\\x00h\\x00A\\x00l\\x00g\\x00o\\x00r\\x00i\\x00t\\x00h\\x00m\\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00\\xffb0EM\\xffc7\\xfffb\\x7f\\x00\\x00x\\xff90\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xffber]D\\x00\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00`g\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00$]A\\xffbfP\\xffe2\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffaa\\xffca\\xffe4\\xffbc\\x01\\x00\\x00x\\xff90\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00P\\xff90\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d!\\xffc7\\xfffb\\x7f\\x00\\x00`g\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff90\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00`g\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\xff90\\xffaa\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\x10\\xffb4\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s!\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffaa\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\xffa0\\xffb8\\xffc7\\xffe4\\xffbc\\x01\\x00\\x00\\xffa0\\xffb8\\xffc7\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`g\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffb8\\xffc7\\xffe4\\xffbc\\x01\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00`g\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x10\\xffb4\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xffbfr]D\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffbb\\xffc7\\xffe4\\xffbc\\x01\\x00\\x00P\\xff90\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2421 }, { "timestamp": "2026-05-28 23:34:31,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b0" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivationType" } ], "repeated": 0, "id": 2422 }, { "timestamp": "2026-05-28 23:34:31,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004b0" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Server" } ], "repeated": 0, "id": 2423 }, { "timestamp": "2026-05-28 23:34:31,124", "thread_id": "9840", "caller": "0x7ffbc72022bf", "parentcaller": "0x7ffbc727fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{C5543B33-5C73-4DC5-9211-24077D3B06C5}" }, { "name": "Handle", "value": "0x000004b6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{C5543B33-5C73-4DC5-9211-24077D3B06C5}" } ], "repeated": 0, "id": 2424 }, { "timestamp": "2026-05-28 23:34:31,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b0" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Threading" } ], "repeated": 0, "id": 2425 }, { "timestamp": "2026-05-28 23:34:31,124", "thread_id": "9840", "caller": "0x7ffbc727fa51", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000004b6" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x000004ba" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C5543B33-5C73-4DC5-9211-24077D3B06C5}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2426 }, { "timestamp": "2026-05-28 23:34:31,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b0" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\TrustLevel" } ], "repeated": 0, "id": 2427 }, { "timestamp": "2026-05-28 23:34:31,124", "thread_id": "9840", "caller": "0x7ffbc727fa8c", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ba" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C5543B33-5C73-4DC5-9211-24077D3B06C5}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2428 }, { "timestamp": "2026-05-28 23:34:31,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004b0" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\CustomAttributes" } ], "repeated": 0, "id": 2429 }, { "timestamp": "2026-05-28 23:34:31,124", "thread_id": "9840", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2430 }, { "timestamp": "2026-05-28 23:34:31,124", "thread_id": "9840", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2431 }, { "timestamp": "2026-05-28 23:34:31,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004b0" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\RemoteServer" } ], "repeated": 0, "id": 2432 }, { "timestamp": "2026-05-28 23:34:31,124", "thread_id": "9840", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4cb0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2433 }, { "timestamp": "2026-05-28 23:34:31,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004b0" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateAsUser" } ], "repeated": 0, "id": 2434 }, { "timestamp": "2026-05-28 23:34:31,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004b0" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2435 }, { "timestamp": "2026-05-28 23:34:31,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004b0" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2436 }, { "timestamp": "2026-05-28 23:34:31,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004b0" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Permissions" } ], "repeated": 0, "id": 2437 }, { "timestamp": "2026-05-28 23:34:31,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004b0" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2438 }, { "timestamp": "2026-05-28 23:34:31,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b0" } ], "repeated": 0, "id": 2439 }, { "timestamp": "2026-05-28 23:34:31,139", "thread_id": "9840", "caller": "0x7ffbc7b97830", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbb0a1a000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2440 }, { "timestamp": "2026-05-28 23:34:31,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000001ac" }, { "name": "HandleName", "value": "\\Device\\KsecDD" }, { "name": "IoControlCode", "value": "0x00390400" }, { "name": "InputBuffer", "value": "M<+\\x1a\\x00\\x00\\x02\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00S\\x00H\\x00A\\x002\\x005\\x006\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00A\\x002\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xa0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffS\\x00H\\x00A\\x002\\x005\\x006\\x00\\x00\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00P\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00 \\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00c\\x00r\\x00y\\x00p\\x00t\\x00p\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00s\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2441 }, { "timestamp": "2026-05-28 23:34:31,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "bcryptprimitives.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc5750000" }, { "name": "FunctionName", "value": "GetHashInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc5764460" } ], "repeated": 0, "id": 2442 }, { "timestamp": "2026-05-28 23:34:31,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "Expiration" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\Expiration" } ], "repeated": 0, "id": 2443 }, { "timestamp": "2026-05-28 23:34:31,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" } ], "repeated": 0, "id": 2444 }, { "timestamp": "2026-05-28 23:34:31,155", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a8" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000344" }, { "name": "ObjectAttributesName", "value": "Windows.ApplicationModel.Core.CoreApplication" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication" } ], "repeated": 0, "id": 2445 }, { "timestamp": "2026-05-28 23:34:31,155", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a8" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00Z\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00C\\x00o\\x00r\\x00e\\x00.\\x00C\\x00o\\x00r\\x00e\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00\\x00\\x00D\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EM\\xffc7\\xfffb\\x7f\\x00\\x00x\\xff92\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffc1r]D\\x00\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00P\\xff9b\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00dXA\\xffbfP\\xffe2\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffa7\\xffca\\xffe4\\xffbc\\x01\\x00\\x00x\\xff92\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00P\\xff92\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d!\\xffc7\\xfffb\\x7f\\x00\\x00P\\xff9b\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff92\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00P\\xff9b\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\xff90\\xffa7\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\xfff0\\xffb5\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s!\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffa7\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\xffc0\\xff90\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\xffc0\\xff90\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff9b\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\xff90\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00P\\xff9b\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\xfff0\\xffb5\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffc2r]D\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffb0\\xffc7\\xffe4\\xffbc\\x01\\x00\\x00P\\xff92\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2446 }, { "timestamp": "2026-05-28 23:34:31,155", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivationType" } ], "repeated": 0, "id": 2447 }, { "timestamp": "2026-05-28 23:34:31,155", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Server" } ], "repeated": 0, "id": 2448 }, { "timestamp": "2026-05-28 23:34:31,155", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\twinapi.appcore.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\DllPath" } ], "repeated": 0, "id": 2449 }, { "timestamp": "2026-05-28 23:34:31,155", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Threading" } ], "repeated": 0, "id": 2450 }, { "timestamp": "2026-05-28 23:34:31,155", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\TrustLevel" } ], "repeated": 0, "id": 2451 }, { "timestamp": "2026-05-28 23:34:31,155", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004a8" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\CustomAttributes" } ], "repeated": 0, "id": 2452 }, { "timestamp": "2026-05-28 23:34:31,155", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\RemoteServer" } ], "repeated": 0, "id": 2453 }, { "timestamp": "2026-05-28 23:34:31,155", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateAsUser" } ], "repeated": 0, "id": 2454 }, { "timestamp": "2026-05-28 23:34:31,155", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2455 }, { "timestamp": "2026-05-28 23:34:31,155", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2456 }, { "timestamp": "2026-05-28 23:34:31,155", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Permissions" } ], "repeated": 0, "id": 2457 }, { "timestamp": "2026-05-28 23:34:31,155", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2458 }, { "timestamp": "2026-05-28 23:34:31,155", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" } ], "repeated": 0, "id": 2459 }, { "timestamp": "2026-05-28 23:34:31,155", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "ApplicationService:24ec1dceefa87ab68be" } ], "repeated": 0, "id": 2460 }, { "timestamp": "2026-05-28 23:34:31,170", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" } ], "repeated": 0, "id": 2461 }, { "timestamp": "2026-05-28 23:34:31,170", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bcfa30" } ], "repeated": 0, "id": 2462 }, { "timestamp": "2026-05-28 23:34:31,170", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4cb2000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2463 }, { "timestamp": "2026-05-28 23:34:31,170", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2464 }, { "timestamp": "2026-05-28 23:34:31,577", "thread_id": "9592", "caller": "0x7ffbc7b70880", "parentcaller": "0x7ffbc7b73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce68fc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2465 }, { "timestamp": "2026-05-28 23:34:31,577", "thread_id": "9592", "caller": "0x7ffbc7b70880", "parentcaller": "0x7ffbc7b73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce685e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2466 }, { "timestamp": "2026-05-28 23:34:31,577", "thread_id": "9592", "caller": "0x7ffbc7b70880", "parentcaller": "0x7ffbc7b73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce68ed000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2467 }, { "timestamp": "2026-05-28 23:34:31,577", "thread_id": "9592", "caller": "0x7ffbc7b70880", "parentcaller": "0x7ffbc7b73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce68f0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2468 }, { "timestamp": "2026-05-28 23:34:31,577", "thread_id": "9592", "caller": "0x7ffbc7b70880", "parentcaller": "0x7ffbc7b73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce68ea000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2469 }, { "timestamp": "2026-05-28 23:34:31,577", "thread_id": "9592", "caller": "0x7ffbc7b70880", "parentcaller": "0x7ffbc7b73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce68fa000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2470 }, { "timestamp": "2026-05-28 23:34:31,577", "thread_id": "9592", "caller": "0x7ffbc7b70880", "parentcaller": "0x7ffbc7b73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce68f6000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2471 }, { "timestamp": "2026-05-28 23:34:31,577", "thread_id": "9592", "caller": "0x7ffbc7b70880", "parentcaller": "0x7ffbc7b73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce68e7000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2472 }, { "timestamp": "2026-05-28 23:34:31,577", "thread_id": "9592", "caller": "0x7ffbc7b70880", "parentcaller": "0x7ffbc7b73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce6b02000" }, { "name": "RegionSize", "value": "0x000fe000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2473 }, { "timestamp": "2026-05-28 23:34:33,264", "thread_id": "9876", "caller": "0x7ffbbf83f406", "parentcaller": "0x7ffbbf800733", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2474 }, { "timestamp": "2026-05-28 23:34:33,264", "thread_id": "9876", "caller": "0x7ffbc728dd9d", "parentcaller": "0x7ffbc7227428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004bc" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000344" }, { "name": "ObjectAttributesName", "value": "Windows.Foundation.Collections.PropertySet" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet" } ], "repeated": 0, "id": 2475 }, { "timestamp": "2026-05-28 23:34:33,264", "thread_id": "9876", "caller": "0x7ffbc728ddf7", "parentcaller": "0x7ffbc7227428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004bc" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00T\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00F\\x00o\\x00u\\x00n\\x00d\\x00a\\x00t\\x00i\\x00o\\x00n\\x00.\\x00C\\x00o\\x00l\\x00l\\x00e\\x00c\\x00t\\x00i\\x00o\\x00n\\x00s\\x00.\\x00P\\x00r\\x00o\\x00p\\x00e\\x00r\\x00t\\x00y\\x00S\\x00e\\x00t\\x00p\\x00P\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x004\\x00\\x00\\x00\\xffb0EM\\xffc7\\xfffb\\x7f\\x00\\x00h\\xfffd\\xffc5\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xfff2\\xffcf^D\\x00\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00\\xffd0\\xff97\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00\\xffb4\\x16\\xfffc\\xffbcP\\xffe2\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffa7\\xffca\\xffe4\\xffbc\\x01\\x00\\x00h\\xfffd\\xffc5\\xffe4\\xffbc\\x01\\x00\\x00@\\xfffd\\xffc5\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d!\\xffc7\\xfffb\\x7f\\x00\\x00\\xffd0\\xff97\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xfffd\\xffc5\\xffe4\\xffbc\\x01\\x00\\x00\\xffd0\\xff97\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\xff90\\xffa7\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\xffa0\\xffb5\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s!\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffa7\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\xffa0\\xff91\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\xffa0\\xff91\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff97\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xff91\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00\\xffd0\\xff97\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\xffa0\\xffb5\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xfff3\\xffcf^D\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xff9a\\xffca\\xffe4\\xffbc\\x01\\x00\\x00@\\xfffd\\xffc5\\xffe4\\xffbc\\x01\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2476 }, { "timestamp": "2026-05-28 23:34:33,264", "thread_id": "9876", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7289cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004bc" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivationType" } ], "repeated": 0, "id": 2477 }, { "timestamp": "2026-05-28 23:34:33,264", "thread_id": "9876", "caller": "0x7ffbc71e7deb", "parentcaller": "0x7ffbc7298ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004bc" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Server" } ], "repeated": 0, "id": 2478 }, { "timestamp": "2026-05-28 23:34:33,264", "thread_id": "9876", "caller": "0x7ffbc71e7deb", "parentcaller": "0x7ffbc72a00bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004bc" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\DllPath" } ], "repeated": 0, "id": 2479 }, { "timestamp": "2026-05-28 23:34:33,264", "thread_id": "9876", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7289cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004bc" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Threading" } ], "repeated": 0, "id": 2480 }, { "timestamp": "2026-05-28 23:34:33,264", "thread_id": "9876", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7289cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004bc" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\TrustLevel" } ], "repeated": 0, "id": 2481 }, { "timestamp": "2026-05-28 23:34:33,264", "thread_id": "9876", "caller": "0x7ffbc71ec0fc", "parentcaller": "0x7ffbc7284170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004bc" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\CustomAttributes" } ], "repeated": 0, "id": 2482 }, { "timestamp": "2026-05-28 23:34:33,264", "thread_id": "9876", "caller": "0x7ffbc71e7deb", "parentcaller": "0x7ffbc7298ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004bc" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\RemoteServer" } ], "repeated": 0, "id": 2483 }, { "timestamp": "2026-05-28 23:34:33,264", "thread_id": "9876", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7289cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004bc" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateAsUser" } ], "repeated": 0, "id": 2484 }, { "timestamp": "2026-05-28 23:34:33,264", "thread_id": "9876", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7289cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004bc" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2485 }, { "timestamp": "2026-05-28 23:34:33,264", "thread_id": "9876", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7289cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004bc" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2486 }, { "timestamp": "2026-05-28 23:34:33,264", "thread_id": "9876", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7292222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004bc" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Permissions" } ], "repeated": 0, "id": 2487 }, { "timestamp": "2026-05-28 23:34:33,264", "thread_id": "9876", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7289cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004bc" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2488 }, { "timestamp": "2026-05-28 23:34:33,264", "thread_id": "9876", "caller": "0x7ffbc7287226", "parentcaller": "0x7ffbc728ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004bc" } ], "repeated": 0, "id": 2489 }, { "timestamp": "2026-05-28 23:34:33,264", "thread_id": "9876", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "BaseAddress", "value": "0x7ffbc1080000" } ], "repeated": 0, "id": 2490 }, { "timestamp": "2026-05-28 23:34:33,264", "thread_id": "9876", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc1080000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 2491 }, { "timestamp": "2026-05-28 23:34:33,264", "thread_id": "9876", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbc7226acf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "wintypes.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc1080000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc1089590" } ], "repeated": 0, "id": 2492 }, { "timestamp": "2026-05-28 23:34:33,264", "thread_id": "9876", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbc7226ae8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "wintypes.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc1080000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc10890f0" } ], "repeated": 0, "id": 2493 }, { "timestamp": "2026-05-28 23:34:33,264", "thread_id": "9876", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbc7226b08", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "wintypes.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc1080000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc10947b0" } ], "repeated": 0, "id": 2494 }, { "timestamp": "2026-05-28 23:34:33,264", "thread_id": "9876", "caller": "0x7ffbc7b97830", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc11bd000" }, { "name": "ModuleName", "value": "wintypes.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2495 }, { "timestamp": "2026-05-28 23:34:33,264", "thread_id": "9876", "caller": "0x7ffbc7b97881", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc11bd000" }, { "name": "ModuleName", "value": "wintypes.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2496 }, { "timestamp": "2026-05-28 23:34:33,280", "thread_id": "9876", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4cb4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2497 }, { "timestamp": "2026-05-28 23:34:33,280", "thread_id": "9876", "caller": "0x7ffbbf8091f4", "parentcaller": "0x7ffbbf808d56", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2498 }, { "timestamp": "2026-05-28 23:34:33,280", "thread_id": "9876", "caller": "0x7ffbbf80926f", "parentcaller": "0x7ffbbf808d56", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xc0`\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00`a\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80a\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x94b\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8b\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xb0b\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0b\\xc9\\xe4\\xbc\\x01\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xd8b\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8b\\xc9\\xe4\\xbc\\x01\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\xb0a\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x006b\\xc9\\xe4\\xbc\\x01\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00U\\x00I\\x00.\\x00S\\x00h\\x00e\\x00l\\x00l\\x00.\\x00T\\x00a\\x00s\\x00k\\x00b\\x00a\\x00r\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EM\\xffc7\\xfffb\\x7f\\x00\\x00\\xfff8\\xff97\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\xffccr]D\\x00\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00\\xffb0f\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00\\xffd4,A\\xffbfP\\xffe2\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff93\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00\\xfff8\\xff97\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\xffd0\\xff97\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d!\\xffc7\\xfffb\\x7f\\x00\\x00\\xffb0f\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff97\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\xffb0f\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00\\x10\\xff93\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00\\xff90\\xffb6\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s!\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff93\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\xffc6\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\xffc6\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0f\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc6\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00\\xffb0f\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00\\xff90\\xffb6\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\xffcdr]D\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffc2\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00\\xffd0\\xff97\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 3126 }, { "timestamp": "2026-05-28 23:34:33,389", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivationType" } ], "repeated": 0, "id": 3127 }, { "timestamp": "2026-05-28 23:34:33,389", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Server" } ], "repeated": 0, "id": 3128 }, { "timestamp": "2026-05-28 23:34:33,389", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\wpnapps.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\DllPath" } ], "repeated": 0, "id": 3129 }, { "timestamp": "2026-05-28 23:34:33,389", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Threading" } ], "repeated": 0, "id": 3130 }, { "timestamp": "2026-05-28 23:34:33,389", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\TrustLevel" } ], "repeated": 0, "id": 3131 }, { "timestamp": "2026-05-28 23:34:33,389", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004d0" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\CustomAttributes" } ], "repeated": 0, "id": 3132 }, { "timestamp": "2026-05-28 23:34:33,389", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\RemoteServer" } ], "repeated": 0, "id": 3133 }, { "timestamp": "2026-05-28 23:34:33,389", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateAsUser" } ], "repeated": 0, "id": 3134 }, { "timestamp": "2026-05-28 23:34:33,389", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInSharedBroker" } ], "repeated": 0, "id": 3135 }, { "timestamp": "2026-05-28 23:34:33,389", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 3136 }, { "timestamp": "2026-05-28 23:34:33,389", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Permissions" } ], "repeated": 0, "id": 3137 }, { "timestamp": "2026-05-28 23:34:33,389", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3138 }, { "timestamp": "2026-05-28 23:34:33,389", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" } ], "repeated": 0, "id": 3139 }, { "timestamp": "2026-05-28 23:34:33,389", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d0" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000344" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.ApplicationModel.TaskbarPinnableSurface" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface" } ], "repeated": 0, "id": 3140 }, { "timestamp": "2026-05-28 23:34:33,389", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d0" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00p\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00T\\x00a\\x00s\\x00k\\x00b\\x00a\\x00r\\x00P\\x00i\\x00n\\x00n\\x00a\\x00b\\x00l\\x00e\\x00S\\x00u\\x00r\\x00f\\x00a\\x00c\\x00e\\x00\\xffb0EM\\xffc7\\xfffb\\x7f\\x00\\x00\\xfff8\\xff91\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xffccr]D\\x00\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00`u\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00\\xffc4,A\\xffbfP\\xffe2\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xff90\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00\\xfff8\\xff91\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\xffd0\\xff91\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d!\\xffc7\\xfffb\\x7f\\x00\\x00`u\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff91\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00`u\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00\\xff90\\xff90\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\xffb5\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s!\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xff90\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\xffcd\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\xffcd\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`u\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffcd\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00`u\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\xffb5\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xffcdr]D\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffca\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00\\xffd0\\xff91\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 3141 }, { "timestamp": "2026-05-28 23:34:33,389", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivationType" } ], "repeated": 0, "id": 3142 }, { "timestamp": "2026-05-28 23:34:33,389", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Server" } ], "repeated": 0, "id": 3143 }, { "timestamp": "2026-05-28 23:34:33,389", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\windows.internal.shell.broker.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\DllPath" } ], "repeated": 0, "id": 3144 }, { "timestamp": "2026-05-28 23:34:33,389", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Threading" } ], "repeated": 0, "id": 3145 }, { "timestamp": "2026-05-28 23:34:33,389", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\TrustLevel" } ], "repeated": 0, "id": 3146 }, { "timestamp": "2026-05-28 23:34:33,389", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004d0" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\CustomAttributes" } ], "repeated": 0, "id": 3147 }, { "timestamp": "2026-05-28 23:34:33,405", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\RemoteServer" } ], "repeated": 0, "id": 3148 }, { "timestamp": "2026-05-28 23:34:33,405", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateAsUser" } ], "repeated": 0, "id": 3149 }, { "timestamp": "2026-05-28 23:34:33,405", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInSharedBroker" } ], "repeated": 0, "id": 3150 }, { "timestamp": "2026-05-28 23:34:33,405", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 3151 }, { "timestamp": "2026-05-28 23:34:33,405", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Permissions" } ], "repeated": 0, "id": 3152 }, { "timestamp": "2026-05-28 23:34:33,405", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3153 }, { "timestamp": "2026-05-28 23:34:33,405", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" } ], "repeated": 0, "id": 3154 }, { "timestamp": "2026-05-28 23:34:33,405", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\dxgi" }, { "name": "DllBase", "value": "0x7ffbc3af0000" } ], "repeated": 0, "id": 3155 }, { "timestamp": "2026-05-28 23:34:33,405", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\d3d11" }, { "name": "DllBase", "value": "0x7ffbc1c00000" } ], "repeated": 0, "id": 3156 }, { "timestamp": "2026-05-28 23:34:33,405", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\WININET" }, { "name": "DllBase", "value": "0x7ffbb7020000" } ], "repeated": 0, "id": 3157 }, { "timestamp": "2026-05-28 23:34:33,405", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 26, "id": 3158 }, { "timestamp": "2026-05-28 23:34:33,436", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\windows.internal.shell.broker" }, { "name": "DllBase", "value": "0x7ffbac200000" } ], "repeated": 0, "id": 3159 }, { "timestamp": "2026-05-28 23:34:33,452", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "gdi32.dll" }, { "name": "BaseAddress", "value": "0x7ffbc6d10000" } ], "repeated": 0, "id": 3160 }, { "timestamp": "2026-05-28 23:34:33,530", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3161 }, { "timestamp": "2026-05-28 23:34:33,530", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\windows.internal.shell.broker.dll" }, { "name": "BaseAddress", "value": "0x7ffbac200000" } ], "repeated": 0, "id": 3162 }, { "timestamp": "2026-05-28 23:34:33,530", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbac200000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\windows.internal.shell.broker.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 3163 }, { "timestamp": "2026-05-28 23:34:33,530", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "windows.internal.shell.broker.dll" }, { "name": "ModuleHandle", "value": "0x7ffbac200000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbac241860" } ], "repeated": 0, "id": 3164 }, { "timestamp": "2026-05-28 23:34:33,530", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "windows.internal.shell.broker.dll" }, { "name": "ModuleHandle", "value": "0x7ffbac200000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbac222a90" } ], "repeated": 0, "id": 3165 }, { "timestamp": "2026-05-28 23:34:33,530", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "windows.internal.shell.broker.dll" }, { "name": "ModuleHandle", "value": "0x7ffbac200000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbac2203b0" } ], "repeated": 0, "id": 3166 }, { "timestamp": "2026-05-28 23:34:33,577", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" } ], "repeated": 0, "id": 3167 }, { "timestamp": "2026-05-28 23:34:33,577", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7b593b0" } ], "repeated": 0, "id": 3168 }, { "timestamp": "2026-05-28 23:34:33,577", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7befc40" } ], "repeated": 0, "id": 3169 }, { "timestamp": "2026-05-28 23:34:33,577", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7b92460" } ], "repeated": 0, "id": 3170 }, { "timestamp": "2026-05-28 23:34:33,577", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bcfa30" } ], "repeated": 0, "id": 3171 }, { "timestamp": "2026-05-28 23:34:33,577", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bacbd0" } ], "repeated": 0, "id": 3172 }, { "timestamp": "2026-05-28 23:34:33,577", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bb3410" } ], "repeated": 0, "id": 3173 }, { "timestamp": "2026-05-28 23:34:33,577", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000514" }, { "name": "MutexName", "value": "Local\\SM0:9452:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 3174 }, { "timestamp": "2026-05-28 23:34:33,577", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000514" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3175 }, { "timestamp": "2026-05-28 23:34:33,577", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3176 }, { "timestamp": "2026-05-28 23:34:33,577", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000518" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3177 }, { "timestamp": "2026-05-28 23:34:33,577", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3178 }, { "timestamp": "2026-05-28 23:34:33,577", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3179 }, { "timestamp": "2026-05-28 23:34:33,577", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051c" } ], "repeated": 0, "id": 3180 }, { "timestamp": "2026-05-28 23:34:33,577", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000518" } ], "repeated": 0, "id": 3181 }, { "timestamp": "2026-05-28 23:34:33,577", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000514" } ], "repeated": 0, "id": 3182 }, { "timestamp": "2026-05-28 23:34:33,577", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000514" } ], "repeated": 0, "id": 3183 }, { "timestamp": "2026-05-28 23:34:33,592", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3184 }, { "timestamp": "2026-05-28 23:34:33,592", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "6D5140C1-7436-11CE-8034-00AA006009FA" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3185 }, { "timestamp": "2026-05-28 23:34:33,592", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3186 }, { "timestamp": "2026-05-28 23:34:33,592", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3187 }, { "timestamp": "2026-05-28 23:34:33,592", "thread_id": "10100", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c81000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3188 }, { "timestamp": "2026-05-28 23:34:33,592", "thread_id": "10100", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800226000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3189 }, { "timestamp": "2026-05-28 23:34:33,592", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3190 }, { "timestamp": "2026-05-28 23:34:33,592", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3191 }, { "timestamp": "2026-05-28 23:34:33,592", "thread_id": "10100", "caller": "0x7ffbc7bc507d", "parentcaller": "0x7ffbc7bc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3192 }, { "timestamp": "2026-05-28 23:34:33,592", "thread_id": "10100", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ffbc7ba2b30" }, { "name": "Parameter", "value": "0x1bce4c02340" } ], "repeated": 0, "id": 3193 }, { "timestamp": "2026-05-28 23:34:33,592", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}" }, { "name": "Handle", "value": "0x00000526" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}" } ], "repeated": 0, "id": 3194 }, { "timestamp": "2026-05-28 23:34:33,592", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000526" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000052a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}\\ProxyStubClsid32" } ], "repeated": 0, "id": 3195 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000052a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 3196 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000052a" } ], "repeated": 0, "id": 3197 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000526" } ], "repeated": 0, "id": 3198 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000376" }, { "name": "SubKey", "value": "CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "Handle", "value": "0x00000526" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" } ], "repeated": 0, "id": 3199 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000526" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3200 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000526" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3201 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xabr]D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00&\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00\\xc0\\xacr]D\\x00\\x00\\x00" } ], "repeated": 0, "id": 3202 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs" } ], "repeated": 0, "id": 3203 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000526" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3204 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000526" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs" } ], "repeated": 0, "id": 3205 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000526" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3206 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000526" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3207 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000526" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)" } ], "repeated": 0, "id": 3208 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000526" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)" } ], "repeated": 0, "id": 3209 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000526" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x0000052a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocServer32" } ], "repeated": 0, "id": 3210 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000052a" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 3211 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000052a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 3212 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000052a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\PCShellCommonProxyStub.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 3213 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000052a" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 3214 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000052a" } ], "repeated": 0, "id": 3215 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000526" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3216 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000526" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3217 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xaar]D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00&\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00P\\xabr]D\\x00\\x00\\x00" } ], "repeated": 0, "id": 3218 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32" } ], "repeated": 0, "id": 3219 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000526" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3220 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000526" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32" } ], "repeated": 0, "id": 3221 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000526" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3222 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000526" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3223 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xaar]D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00&\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00P\\xabr]D\\x00\\x00\\x00" } ], "repeated": 0, "id": 3224 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler" } ], "repeated": 0, "id": 3225 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000526" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3226 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000526" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler" } ], "repeated": 0, "id": 3227 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000526" } ], "repeated": 0, "id": 3228 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3229 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3230 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000376" }, { "name": "SubKey", "value": "CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "Handle", "value": "0x00000526" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" } ], "repeated": 0, "id": 3231 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000526" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3232 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000526" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3233 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xa8r]D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00&\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00\\x80\\xa9r]D\\x00\\x00\\x00" } ], "repeated": 0, "id": 3234 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs" } ], "repeated": 0, "id": 3235 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000526" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3236 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000526" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs" } ], "repeated": 0, "id": 3237 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000526" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3238 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000526" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3239 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000526" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)" } ], "repeated": 0, "id": 3240 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000526" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)" } ], "repeated": 0, "id": 3241 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000526" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x0000052a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocServer32" } ], "repeated": 0, "id": 3242 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000052a" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 3243 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000052a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 3244 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000052a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\PCShellCommonProxyStub.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 3245 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000052a" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 3246 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000052a" } ], "repeated": 0, "id": 3247 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000526" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3248 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000526" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3249 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xa7r]D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00&\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00\\x10\\xa8r]D\\x00\\x00\\x00" } ], "repeated": 0, "id": 3250 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32" } ], "repeated": 0, "id": 3251 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000526" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3252 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000526" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32" } ], "repeated": 0, "id": 3253 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000526" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3254 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000526" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3255 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xa7r]D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00&\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00\\x10\\xa8r]D\\x00\\x00\\x00" } ], "repeated": 0, "id": 3256 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler" } ], "repeated": 0, "id": 3257 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000526" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3258 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000526" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler" } ], "repeated": 0, "id": 3259 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000526" }, { "name": "SubKey", "value": "LocalServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\LocalServer32" } ], "repeated": 0, "id": 3260 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000526" }, { "name": "ValueName", "value": "AppID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\AppID" } ], "repeated": 0, "id": 3261 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000526" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3262 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000526" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3263 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xa6r]D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00&\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00P\\xa7r]D\\x00\\x00\\x00" } ], "repeated": 0, "id": 3264 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\LocalServer" } ], "repeated": 0, "id": 3265 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000526" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3266 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000526" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\LocalServer" } ], "repeated": 0, "id": 3267 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000376" }, { "name": "SubKey", "value": "CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "Handle", "value": "0x0000052a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" } ], "repeated": 0, "id": 3268 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000052a" }, { "name": "SubKey", "value": "Elevation" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\Elevation" } ], "repeated": 0, "id": 3269 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000052a" } ], "repeated": 0, "id": 3270 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000526" } ], "repeated": 0, "id": 3271 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "Handle", "value": "0x00000526" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" } ], "repeated": 0, "id": 3272 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000526" }, { "name": "SubKey", "value": "TreatAs" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs" } ], "repeated": 0, "id": 3273 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000526" } ], "repeated": 0, "id": 3274 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3275 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3276 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\PCShellCommonProxyStub" }, { "name": "DllBase", "value": "0x7ffbad3e0000" } ], "repeated": 0, "id": 3277 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\PCShellCommonProxyStub.dll" }, { "name": "BaseAddress", "value": "0x7ffbad3e0000" } ], "repeated": 0, "id": 3278 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbad3e0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\PCShellCommonProxyStub.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 3279 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "PCShellCommonProxyStub.dll" }, { "name": "ModuleHandle", "value": "0x7ffbad3e0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbad3e1660" } ], "repeated": 0, "id": 3280 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "PCShellCommonProxyStub.dll" }, { "name": "ModuleHandle", "value": "0x7ffbad3e0000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 3281 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "PCShellCommonProxyStub.dll" }, { "name": "ModuleHandle", "value": "0x7ffbad3e0000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbad3e16a0" } ], "repeated": 0, "id": 3282 }, { "timestamp": "2026-05-28 23:34:33,608", "thread_id": "10100", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc703ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000530" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 3283 }, { "timestamp": "2026-05-28 23:34:33,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3284 }, { "timestamp": "2026-05-28 23:34:33,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3285 }, { "timestamp": "2026-05-28 23:34:33,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" } ], "repeated": 0, "id": 3286 }, { "timestamp": "2026-05-28 23:34:33,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7b593b0" } ], "repeated": 0, "id": 3287 }, { "timestamp": "2026-05-28 23:34:33,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7befc40" } ], "repeated": 0, "id": 3288 }, { "timestamp": "2026-05-28 23:34:33,624", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7b92460" } ], "repeated": 0, "id": 3289 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bcfa30" } ], "repeated": 0, "id": 3290 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bacbd0" } ], "repeated": 0, "id": 3291 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bb3410" } ], "repeated": 0, "id": 3292 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000534" }, { "name": "MutexName", "value": "Local\\SM0:9452:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 3293 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000534" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3294 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3295 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000538" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3296 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3297 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3298 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053c" } ], "repeated": 0, "id": 3299 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000538" } ], "repeated": 0, "id": 3300 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000534" } ], "repeated": 0, "id": 3301 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000534" } ], "repeated": 0, "id": 3302 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3303 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x93\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\xa0\\x93\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x93\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\xd4\\x94\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\x94\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xf0\\x94\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x95\\xc9\\xe4\\xbc\\x01\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x18\\x95\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\x95\\xc9\\xe4\\xbc\\x01\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\xf0\\x93\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00v\\x94\\xc9\\xe4\\xbc\\x01\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00|\\x94\\xc9\\xe4\\xbc\\x01\\x00\\x00" } ], "repeated": 0, "id": 3304 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053c" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000344" }, { "name": "ObjectAttributesName", "value": "Windows.UI.StartScreen.StartScreenManager" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager" } ], "repeated": 0, "id": 3305 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053c" }, { "name": "KeyInformation", "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00R\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00U\\x00I\\x00.\\x00S\\x00t\\x00a\\x00r\\x00t\\x00S\\x00c\\x00r\\x00e\\x00e\\x00n\\x00.\\x00S\\x00t\\x00a\\x00r\\x00t\\x00S\\x00c\\x00r\\x00e\\x00e\\x00n\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x002\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EM\\xffc7\\xfffb\\x7f\\x00\\x00x\\xff9c\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffc4r]D\\x00\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00P\\xff9a\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00\\xffa4$A\\xffbfP\\xffe2\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xff91\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00x\\xff9c\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00P\\xff9c\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d!\\xffc7\\xfffb\\x7f\\x00\\x00P\\xff9a\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff9c\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00P\\xff9a\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\xff90\\xff91\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00 \\xffb3\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s!\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xff91\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00\\x10\\xff99\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\x10\\xff99\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff9a\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff99\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00P\\xff9a\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00 \\xffb3\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffc5r]D\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xff93\\xffca\\xffe4\\xffbc\\x01\\x00\\x00P\\xff9c\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 3306 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053c" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivationType" } ], "repeated": 0, "id": 3307 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000053c" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Server" } ], "repeated": 0, "id": 3308 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053c" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\wpnapps.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\DllPath" } ], "repeated": 0, "id": 3309 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053c" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Threading" } ], "repeated": 0, "id": 3310 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053c" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\TrustLevel" } ], "repeated": 0, "id": 3311 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000053c" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\CustomAttributes" } ], "repeated": 0, "id": 3312 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000053c" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\RemoteServer" } ], "repeated": 0, "id": 3313 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000053c" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateAsUser" } ], "repeated": 0, "id": 3314 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000053c" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInSharedBroker" } ], "repeated": 0, "id": 3315 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053c" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 3316 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000053c" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Permissions" } ], "repeated": 0, "id": 3317 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000053c" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3318 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053c" } ], "repeated": 0, "id": 3319 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9880", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7272ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000508" } ], "repeated": 0, "id": 3320 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000524" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000344" }, { "name": "ObjectAttributesName", "value": "Windows.System.User" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User" } ], "repeated": 0, "id": 3321 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000524" }, { "name": "KeyInformation", "value": "\\xffd9E\\x04\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00&\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00.\\x00U\\x00s\\x00e\\x00r\\x00\\x00\\x00\\xff88\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EM\\xffc7\\xfffb\\x7f\\x00\\x00x\\xff9c\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffc4r]D\\x00\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00\\xff90\\xffb6\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00d'A\\xffbfP\\xffe2\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xff91\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00x\\xff9c\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00P\\xff9c\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d!\\xffc7\\xfffb\\x7f\\x00\\x00\\xff90\\xffb6\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff9c\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\xff90\\xffb6\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00\\xff90\\xff91\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00P\\xffb0\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s!\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xff91\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00\\xffe0\\xff9d\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\xffe0\\xff9d\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffb6\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xff9d\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00\\xff90\\xffb6\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00P\\xffb0\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffc5r]D\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff97\\xffca\\xffe4\\xffbc\\x01\\x00\\x00P\\xff9c\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 3322 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivationType" } ], "repeated": 0, "id": 3323 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "ValueName", "value": "Server" }, { "name": "Data", "value": "UserManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Server" } ], "repeated": 0, "id": 3324 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\DllPath" } ], "repeated": 0, "id": 3325 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Threading" } ], "repeated": 0, "id": 3326 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\TrustLevel" } ], "repeated": 0, "id": 3327 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000524" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\CustomAttributes" } ], "repeated": 0, "id": 3328 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\RemoteServer" } ], "repeated": 0, "id": 3329 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateAsUser" } ], "repeated": 0, "id": 3330 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInSharedBroker" } ], "repeated": 0, "id": 3331 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 3332 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Type", "value": "0x4400000003" }, { "name": "DataLength", "value": "184" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Permissions" } ], "repeated": 0, "id": 3333 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Data", "value": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Permissions" } ], "repeated": 0, "id": 3334 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3335 }, { "timestamp": "2026-05-28 23:34:33,639", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" } ], "repeated": 0, "id": 3336 }, { "timestamp": "2026-05-28 23:34:33,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3337 }, { "timestamp": "2026-05-28 23:34:33,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3338 }, { "timestamp": "2026-05-28 23:34:33,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3339 }, { "timestamp": "2026-05-28 23:34:33,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}" }, { "name": "Handle", "value": "0x00000526" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}" } ], "repeated": 0, "id": 3340 }, { "timestamp": "2026-05-28 23:34:33,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000526" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000476" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}\\ProxyStubClsid32" } ], "repeated": 0, "id": 3341 }, { "timestamp": "2026-05-28 23:34:33,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000476" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 3342 }, { "timestamp": "2026-05-28 23:34:33,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000476" } ], "repeated": 0, "id": 3343 }, { "timestamp": "2026-05-28 23:34:33,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000526" } ], "repeated": 0, "id": 3344 }, { "timestamp": "2026-05-28 23:34:33,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3345 }, { "timestamp": "2026-05-28 23:34:33,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3346 }, { "timestamp": "2026-05-28 23:34:33,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3347 }, { "timestamp": "2026-05-28 23:34:33,655", "thread_id": "10100", "caller": "0x7ffbc72022bf", "parentcaller": "0x7ffbc727fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{E44EA1DF-BB85-5A8C-BDDC-C8E960C355C9}" }, { "name": "Handle", "value": "0x0000053e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{E44EA1DF-BB85-5A8C-BDDC-C8E960C355C9}" } ], "repeated": 0, "id": 3348 }, { "timestamp": "2026-05-28 23:34:33,655", "thread_id": "10100", "caller": "0x7ffbc727fa51", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000053e" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000542" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{e44ea1df-bb85-5a8c-bddc-c8e960c355c9}\\ProxyStubClsid32" } ], "repeated": 0, "id": 3349 }, { "timestamp": "2026-05-28 23:34:33,655", "thread_id": "10100", "caller": "0x7ffbc727fa8c", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000542" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{e44ea1df-bb85-5a8c-bddc-c8e960c355c9}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 3350 }, { "timestamp": "2026-05-28 23:34:33,655", "thread_id": "10100", "caller": "0x7ffbc727fad3", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000542" } ], "repeated": 0, "id": 3351 }, { "timestamp": "2026-05-28 23:34:33,655", "thread_id": "10100", "caller": "0x7ffbc727fae4", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053e" } ], "repeated": 0, "id": 3352 }, { "timestamp": "2026-05-28 23:34:33,655", "thread_id": "10100", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3353 }, { "timestamp": "2026-05-28 23:34:33,655", "thread_id": "10100", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3354 }, { "timestamp": "2026-05-28 23:34:33,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" } ], "repeated": 0, "id": 3355 }, { "timestamp": "2026-05-28 23:34:33,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{8CBD762A-1222-5EE5-B745-489E7A42C6EC}" }, { "name": "Handle", "value": "0x00000526" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8CBD762A-1222-5EE5-B745-489E7A42C6EC}" } ], "repeated": 0, "id": 3356 }, { "timestamp": "2026-05-28 23:34:33,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000526" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000052a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8cbd762a-1222-5ee5-b745-489e7a42c6ec}\\ProxyStubClsid32" } ], "repeated": 0, "id": 3357 }, { "timestamp": "2026-05-28 23:34:33,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000052a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8cbd762a-1222-5ee5-b745-489e7a42c6ec}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 3358 }, { "timestamp": "2026-05-28 23:34:33,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000052a" } ], "repeated": 0, "id": 3359 }, { "timestamp": "2026-05-28 23:34:33,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000526" } ], "repeated": 0, "id": 3360 }, { "timestamp": "2026-05-28 23:34:33,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3361 }, { "timestamp": "2026-05-28 23:34:33,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3362 }, { "timestamp": "2026-05-28 23:34:33,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3363 }, { "timestamp": "2026-05-28 23:34:33,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3364 }, { "timestamp": "2026-05-28 23:34:33,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3365 }, { "timestamp": "2026-05-28 23:34:33,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3366 }, { "timestamp": "2026-05-28 23:34:33,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "99B29D3B-368A-4BE6-B675-805A69114497" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3367 }, { "timestamp": "2026-05-28 23:34:33,670", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3368 }, { "timestamp": "2026-05-28 23:34:33,670", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3369 }, { "timestamp": "2026-05-28 23:34:33,670", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3370 }, { "timestamp": "2026-05-28 23:34:33,670", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3371 }, { "timestamp": "2026-05-28 23:34:33,670", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3372 }, { "timestamp": "2026-05-28 23:34:33,670", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3373 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053c" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000344" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.Tiles.TileStore" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore" } ], "repeated": 0, "id": 3374 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053c" }, { "name": "KeyInformation", "value": "7_\\xffea\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00@\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00T\\x00i\\x00l\\x00e\\x00s\\x00.\\x00T\\x00i\\x00l\\x00e\\x00S\\x00t\\x00o\\x00r\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00&\\x00\\x00\\x00\\xfffb\\x7f\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EM\\xffc7\\xfffb\\x7f\\x00\\x00x\\xff9a\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xffc4r]D\\x00\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00\\xffd0\\x1d\\xffc6\\xffe4\\xffbc\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x004'A\\xffbfP\\xffe2\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff9e\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00x\\xff9a\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00P\\xff9a\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d!\\xffc7\\xfffb\\x7f\\x00\\x00\\xffd0\\x1d\\xffc6\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff9a\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\xffd0\\x1d\\xffc6\\xffe4\\xffbc\\x01\\x00\\x00P\\xff9e\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00\\xfff0\\xffb0\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s!\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff9e\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00\\xffd0\\xffba\\xffc7\\xffe4\\xffbc\\x01\\x00\\x00\\xffd0\\xffba\\xffc7\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\x1d\\xffc6\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffba\\xffc7\\xffe4\\xffbc\\x01\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00\\xffd0\\x1d\\xffc6\\xffe4\\xffbc\\x01\\x00\\x00\\xfff0\\xffb0\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xffc5r]D\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffb8\\xffc7\\xffe4\\xffbc\\x01\\x00\\x00P\\xff9a\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 3375 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053c" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivationType" } ], "repeated": 0, "id": 3376 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000053c" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Server" } ], "repeated": 0, "id": 3377 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053c" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\TileDataRepository.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\DllPath" } ], "repeated": 0, "id": 3378 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053c" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Threading" } ], "repeated": 0, "id": 3379 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053c" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\TrustLevel" } ], "repeated": 0, "id": 3380 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000053c" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\CustomAttributes" } ], "repeated": 0, "id": 3381 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000053c" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\RemoteServer" } ], "repeated": 0, "id": 3382 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000053c" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateAsUser" } ], "repeated": 0, "id": 3383 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000053c" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInSharedBroker" } ], "repeated": 0, "id": 3384 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000053c" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 3385 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000053c" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Permissions" } ], "repeated": 0, "id": 3386 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000053c" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3387 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053c" } ], "repeated": 0, "id": 3388 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3389 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3390 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3391 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3392 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3393 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3394 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000474" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3395 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3396 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000474" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3397 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3398 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000474" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3399 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3400 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000042c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3401 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3402 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xf5\\xcc\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 3403 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051c" } ], "repeated": 0, "id": 3404 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3405 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000520" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3406 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3407 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000520" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3408 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3409 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3410 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3411 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3412 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000520" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3413 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3414 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000520" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3415 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000544" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000344" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.StateRepository.TileView" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView" } ], "repeated": 0, "id": 3416 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000544" }, { "name": "KeyInformation", "value": "\\xfffci\\x0e\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00R\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00T\\x00i\\x00l\\x00e\\x00V\\x00i\\x00e\\x00w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1e\\x00\\x00\\x00\\xfffb\\x7f\\x00\\x00>\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EM\\xffc7\\xfffb\\x7f\\x00\\x00x\\xffaf\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xffbfr]D\\x00\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00P\\xff90\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00\\x04[A\\xffbfP\\xffe2\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff9f\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00x\\xffaf\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00P\\xffaf\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d!\\xffc7\\xfffb\\x7f\\x00\\x00P\\xff90\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffaf\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00P\\xff90\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00P\\xff9f\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00P\\xffb0\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s!\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff9f\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00`\\xffca\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00`\\xffca\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff90\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffca\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00P\\xff90\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00P\\xffb0\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xffc0r]D\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffc0\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00P\\xffaf\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 3417 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000544" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivationType" } ], "repeated": 0, "id": 3418 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000544" }, { "name": "ValueName", "value": "Server" }, { "name": "Data", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Server" } ], "repeated": 0, "id": 3419 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000544" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\DllPath" } ], "repeated": 0, "id": 3420 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000544" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Threading" } ], "repeated": 0, "id": 3421 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000544" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\TrustLevel" } ], "repeated": 0, "id": 3422 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000544" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\CustomAttributes" } ], "repeated": 0, "id": 3423 }, { "timestamp": "2026-05-28 23:34:33,686", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000544" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\RemoteServer" } ], "repeated": 0, "id": 3424 }, { "timestamp": "2026-05-28 23:34:33,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000544" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateAsUser" } ], "repeated": 0, "id": 3425 }, { "timestamp": "2026-05-28 23:34:33,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000544" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInSharedBroker" } ], "repeated": 0, "id": 3426 }, { "timestamp": "2026-05-28 23:34:33,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000544" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 3427 }, { "timestamp": "2026-05-28 23:34:33,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000544" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Permissions" } ], "repeated": 0, "id": 3428 }, { "timestamp": "2026-05-28 23:34:33,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000544" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3429 }, { "timestamp": "2026-05-28 23:34:33,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000544" } ], "repeated": 0, "id": 3430 }, { "timestamp": "2026-05-28 23:34:33,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3431 }, { "timestamp": "2026-05-28 23:34:33,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000520" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3432 }, { "timestamp": "2026-05-28 23:34:33,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3433 }, { "timestamp": "2026-05-28 23:34:33,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{6D3BC882-23A4-4706-B8FA-FC7DE2FC325D}" }, { "name": "Handle", "value": "0x00000526" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{6D3BC882-23A4-4706-B8FA-FC7DE2FC325D}" } ], "repeated": 0, "id": 3434 }, { "timestamp": "2026-05-28 23:34:33,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000526" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000052a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{6d3bc882-23a4-4706-b8fa-fc7de2fc325d}\\ProxyStubClsid32" } ], "repeated": 0, "id": 3435 }, { "timestamp": "2026-05-28 23:34:33,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000052a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{6d3bc882-23a4-4706-b8fa-fc7de2fc325d}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 3436 }, { "timestamp": "2026-05-28 23:34:33,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000052a" } ], "repeated": 0, "id": 3437 }, { "timestamp": "2026-05-28 23:34:33,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000526" } ], "repeated": 0, "id": 3438 }, { "timestamp": "2026-05-28 23:34:33,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3439 }, { "timestamp": "2026-05-28 23:34:33,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3440 }, { "timestamp": "2026-05-28 23:34:33,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces" }, { "name": "Handle", "value": "0x0000053c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces" } ], "repeated": 0, "id": 3441 }, { "timestamp": "2026-05-28 23:34:33,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053c" }, { "name": "ValueName", "value": "DefaultStart" }, { "name": "Data", "value": "Windows.Internal.ApplicationModel.StartPinnableSurface" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces\\DefaultStart" } ], "repeated": 0, "id": 3442 }, { "timestamp": "2026-05-28 23:34:33,702", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053c" } ], "repeated": 0, "id": 3443 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000524" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "ApplicationService:24ec1dceefa87ab68be" } ], "repeated": 0, "id": 3444 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000524" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce95e0000" }, { "name": "SectionOffset", "value": "0x445d72cad0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3445 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce9700000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3446 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce9702000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3447 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce9703000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3448 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce95e0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 3449 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" } ], "repeated": 0, "id": 3450 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce9702000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 3451 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "MutexName", "value": "Local\\SM0:9452:120:WilError_03" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 3452 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3453 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3454 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3455 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3456 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3457 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053c" } ], "repeated": 0, "id": 3458 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" } ], "repeated": 0, "id": 3459 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" } ], "repeated": 0, "id": 3460 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" } ], "repeated": 0, "id": 3461 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000524" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000344" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.ApplicationModel.StartPinnableSurface" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface" } ], "repeated": 0, "id": 3462 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000524" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00l\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00S\\x00t\\x00a\\x00r\\x00t\\x00P\\x00i\\x00n\\x00n\\x00a\\x00b\\x00l\\x00e\\x00S\\x00u\\x00r\\x00f\\x00a\\x00c\\x00e\\x00\\x00\\x00\\x00\\x00\\xffb0EM\\xffc7\\xfffb\\x7f\\x00\\x00\\xfff8\\xffa3\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffc3r]D\\x00\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00\\x10\\xff89\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00\\xff94'A\\xffbfP\\xffe2\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xff9a\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00\\xfff8\\xffa3\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\xffd0\\xffa3\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d!\\xffc7\\xfffb\\x7f\\x00\\x00\\x10\\xff89\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffa3\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x10\\xff89\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00\\xff90\\xff9a\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00\\xff90\\xffb1\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s!\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xff9a\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00`\\xffca\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00`\\xffca\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff89\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffca\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00\\x10\\xff89\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00\\xff90\\xffb1\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffc4r]D\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xffcb\\xffcc\\xffe4\\xffbc\\x01\\x00\\x00\\xffd0\\xffa3\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 3463 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivationType" } ], "repeated": 0, "id": 3464 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Server" } ], "repeated": 0, "id": 3465 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\StartTileData.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\DllPath" } ], "repeated": 0, "id": 3466 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Threading" } ], "repeated": 0, "id": 3467 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\TrustLevel" } ], "repeated": 0, "id": 3468 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000524" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\CustomAttributes" } ], "repeated": 0, "id": 3469 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\RemoteServer" } ], "repeated": 0, "id": 3470 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateAsUser" } ], "repeated": 0, "id": 3471 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInSharedBroker" } ], "repeated": 0, "id": 3472 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 3473 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Permissions" } ], "repeated": 0, "id": 3474 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000524" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3475 }, { "timestamp": "2026-05-28 23:34:33,717", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" } ], "repeated": 0, "id": 3476 }, { "timestamp": "2026-05-28 23:34:33,733", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\USERENV" }, { "name": "DllBase", "value": "0x7ffbc5120000" } ], "repeated": 0, "id": 3477 }, { "timestamp": "2026-05-28 23:34:33,733", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Wldp" }, { "name": "DllBase", "value": "0x7ffbc4bf0000" } ], "repeated": 0, "id": 3478 }, { "timestamp": "2026-05-28 23:34:33,733", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\windows.storage" }, { "name": "DllBase", "value": "0x7ffbc3310000" } ], "repeated": 0, "id": 3479 }, { "timestamp": "2026-05-28 23:34:33,733", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Bcp47Langs" }, { "name": "DllBase", "value": "0x7ffbbb460000" } ], "repeated": 0, "id": 3480 }, { "timestamp": "2026-05-28 23:34:33,733", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\StartTileData" }, { "name": "DllBase", "value": "0x7ffbb1090000" } ], "repeated": 0, "id": 3481 }, { "timestamp": "2026-05-28 23:34:33,842", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\StartTileData.dll" }, { "name": "BaseAddress", "value": "0x7ffbb1090000" } ], "repeated": 0, "id": 3482 }, { "timestamp": "2026-05-28 23:34:33,842", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbb1090000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\StartTileData.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 3483 }, { "timestamp": "2026-05-28 23:34:33,842", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "StartTileData.dll" }, { "name": "ModuleHandle", "value": "0x7ffbb1090000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbb1167f30" } ], "repeated": 0, "id": 3484 }, { "timestamp": "2026-05-28 23:34:33,842", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "StartTileData.dll" }, { "name": "ModuleHandle", "value": "0x7ffbb1090000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbb1142270" } ], "repeated": 0, "id": 3485 }, { "timestamp": "2026-05-28 23:34:33,842", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "StartTileData.dll" }, { "name": "ModuleHandle", "value": "0x7ffbb1090000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbb115a890" } ], "repeated": 0, "id": 3486 }, { "timestamp": "2026-05-28 23:34:33,842", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4ce6000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3487 }, { "timestamp": "2026-05-28 23:34:33,889", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000a" }, { "name": "TokenHandle", "value": "0x00000570" } ], "repeated": 0, "id": 3488 }, { "timestamp": "2026-05-28 23:34:33,889", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000570" } ], "repeated": 0, "id": 3489 }, { "timestamp": "2026-05-28 23:34:33,889", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000570" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\SecurityManager\\AdminCapabilities" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\AdminCapabilities" } ], "repeated": 0, "id": 3490 }, { "timestamp": "2026-05-28 23:34:33,889", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000570" }, { "name": "ValueName", "value": "shellExperience" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\shellExperience" } ], "repeated": 0, "id": 3491 }, { "timestamp": "2026-05-28 23:34:33,889", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xc8r]D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00 \\x02\\x00\\x00\\xd0\\x81<%\\x1e2\\x005\\xb7x)\\x13I=\\x97*\\xee\\xce'\\xd6\\x97\\xec#0mJQa\\x00\\x00\\x18\\x00\\x01\\x00\\x00\\x00\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 3492 }, { "timestamp": "2026-05-28 23:34:33,889", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000570" } ], "repeated": 0, "id": 3493 }, { "timestamp": "2026-05-28 23:34:33,889", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4ce7000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3494 }, { "timestamp": "2026-05-28 23:34:33,889", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 3495 }, { "timestamp": "2026-05-28 23:34:33,920", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" } ], "repeated": 0, "id": 3496 }, { "timestamp": "2026-05-28 23:34:33,920", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7b593b0" } ], "repeated": 0, "id": 3497 }, { "timestamp": "2026-05-28 23:34:33,920", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7befc40" } ], "repeated": 0, "id": 3498 }, { "timestamp": "2026-05-28 23:34:33,920", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7b92460" } ], "repeated": 0, "id": 3499 }, { "timestamp": "2026-05-28 23:34:33,920", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bcfa30" } ], "repeated": 0, "id": 3500 }, { "timestamp": "2026-05-28 23:34:33,920", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bacbd0" } ], "repeated": 0, "id": 3501 }, { "timestamp": "2026-05-28 23:34:33,920", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bb3410" } ], "repeated": 0, "id": 3502 }, { "timestamp": "2026-05-28 23:34:33,920", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4cc1000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3503 }, { "timestamp": "2026-05-28 23:34:33,920", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "MutexName", "value": "Local\\SM0:9452:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 3504 }, { "timestamp": "2026-05-28 23:34:33,920", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3505 }, { "timestamp": "2026-05-28 23:34:33,920", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3506 }, { "timestamp": "2026-05-28 23:34:33,920", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000578" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3507 }, { "timestamp": "2026-05-28 23:34:33,920", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3508 }, { "timestamp": "2026-05-28 23:34:33,920", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000057c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3509 }, { "timestamp": "2026-05-28 23:34:33,920", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000057c" } ], "repeated": 0, "id": 3510 }, { "timestamp": "2026-05-28 23:34:33,920", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000578" } ], "repeated": 0, "id": 3511 }, { "timestamp": "2026-05-28 23:34:33,936", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 3512 }, { "timestamp": "2026-05-28 23:34:33,936", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 3513 }, { "timestamp": "2026-05-28 23:34:33,936", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xfc\\x11e\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x1d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00/\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00}\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 3514 }, { "timestamp": "2026-05-28 23:34:33,936", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3515 }, { "timestamp": "2026-05-28 23:34:33,936", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000520" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3516 }, { "timestamp": "2026-05-28 23:34:33,936", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3517 }, { "timestamp": "2026-05-28 23:34:33,936", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000520" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3518 }, { "timestamp": "2026-05-28 23:34:33,936", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3519 }, { "timestamp": "2026-05-28 23:34:33,936", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000520" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3520 }, { "timestamp": "2026-05-28 23:34:33,936", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3521 }, { "timestamp": "2026-05-28 23:34:33,936", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000520" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3522 }, { "timestamp": "2026-05-28 23:34:33,936", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051c" } ], "repeated": 0, "id": 3523 }, { "timestamp": "2026-05-28 23:34:33,936", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3524 }, { "timestamp": "2026-05-28 23:34:33,936", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "6D5140C1-7436-11CE-8034-00AA006009FA" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3525 }, { "timestamp": "2026-05-28 23:34:33,936", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 3526 }, { "timestamp": "2026-05-28 23:34:33,936", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000520" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3527 }, { "timestamp": "2026-05-28 23:34:33,936", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3528 }, { "timestamp": "2026-05-28 23:34:33,936", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000520" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3529 }, { "timestamp": "2026-05-28 23:34:33,936", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3530 }, { "timestamp": "2026-05-28 23:34:33,952", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x93\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\xa0\\x93\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x93\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\xd4\\x94\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\x94\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xf0\\x94\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x95\\xc9\\xe4\\xbc\\x01\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x18\\x95\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\x95\\xc9\\xe4\\xbc\\x01\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\xf0\\x93\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00v\\x94\\xc9\\xe4\\xbc\\x01\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00|\\x94\\xc9\\xe4\\xbc\\x01\\x00\\x00" } ], "repeated": 0, "id": 3531 }, { "timestamp": "2026-05-28 23:34:33,952", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4ce8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3532 }, { "timestamp": "2026-05-28 23:34:33,952", "thread_id": "9880", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7272ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000508" } ], "repeated": 0, "id": 3533 }, { "timestamp": "2026-05-28 23:34:33,952", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3534 }, { "timestamp": "2026-05-28 23:34:33,952", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000520" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3535 }, { "timestamp": "2026-05-28 23:34:33,952", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3536 }, { "timestamp": "2026-05-28 23:34:33,952", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051c" } ], "repeated": 0, "id": 3537 }, { "timestamp": "2026-05-28 23:34:33,952", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3538 }, { "timestamp": "2026-05-28 23:34:33,952", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000520" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3539 }, { "timestamp": "2026-05-28 23:34:33,952", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3540 }, { "timestamp": "2026-05-28 23:34:33,952", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000520" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3541 }, { "timestamp": "2026-05-28 23:34:33,952", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "99B29D3B-368A-4BE6-B675-805A69114497" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3542 }, { "timestamp": "2026-05-28 23:34:33,952", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3543 }, { "timestamp": "2026-05-28 23:34:33,952", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000520" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3544 }, { "timestamp": "2026-05-28 23:34:33,952", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3545 }, { "timestamp": "2026-05-28 23:34:33,952", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000520" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3546 }, { "timestamp": "2026-05-28 23:34:33,952", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3547 }, { "timestamp": "2026-05-28 23:34:33,952", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000520" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3548 }, { "timestamp": "2026-05-28 23:34:33,952", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3549 }, { "timestamp": "2026-05-28 23:34:33,952", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000520" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3550 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3551 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3552 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000520" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3553 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3554 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000518" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3555 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3556 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000518" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3557 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3558 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000518" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3559 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3560 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000520" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3561 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3562 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xf3\\xcc\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\xa4\\xd3\\xd9\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 3563 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051c" } ], "repeated": 0, "id": 3564 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3565 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000474" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3566 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3567 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000474" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3568 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3569 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3570 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3571 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3572 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000474" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3573 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3574 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000474" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3575 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3576 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000474" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3577 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3578 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces" }, { "name": "Handle", "value": "0x00000578" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces" } ], "repeated": 0, "id": 3579 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000578" }, { "name": "ValueName", "value": "DefaultStart" }, { "name": "Data", "value": "Windows.Internal.ApplicationModel.StartPinnableSurface" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces\\DefaultStart" } ], "repeated": 0, "id": 3580 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000578" } ], "repeated": 0, "id": 3581 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000578" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "ApplicationService:24ec1dceefa87ab68be" } ], "repeated": 0, "id": 3582 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000578" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce95e0000" }, { "name": "SectionOffset", "value": "0x445d72cad0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3583 }, { "timestamp": "2026-05-28 23:34:33,967", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce9702000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3584 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce9703000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3585 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce95e0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 3586 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000578" } ], "repeated": 0, "id": 3587 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce9702000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 3588 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000a" }, { "name": "TokenHandle", "value": "0x00000578" } ], "repeated": 0, "id": 3589 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000578" } ], "repeated": 0, "id": 3590 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000578" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\SecurityManager\\AdminCapabilities" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\AdminCapabilities" } ], "repeated": 0, "id": 3591 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000578" }, { "name": "ValueName", "value": "shellExperience" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\shellExperience" } ], "repeated": 0, "id": 3592 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xc8r]D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00 \\x02\\x00\\x00\\xd0\\x81<%\\x1e2\\x005\\xb7x)\\x13I=\\x97*\\xee\\xce'\\xd6\\x97\\xec#0mJQa\\x00\\x00\\x18\\x00\\x01\\x00\\x00\\x00\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 3593 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000578" } ], "repeated": 0, "id": 3594 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000057c" } ], "repeated": 0, "id": 3595 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\x95\\xdbe\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00/\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00}\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 3596 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3597 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000474" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3598 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3599 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000474" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3600 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3601 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000474" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3602 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3603 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000474" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3604 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051c" } ], "repeated": 0, "id": 3605 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xd9\\xece\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x001\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00}\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 3606 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3607 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "Milliseconds", "value": "4651" } ], "repeated": 0, "id": 3608 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9812", "caller": "0x7ffbc54553aa", "parentcaller": "0x1bcec0cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00X\\xf0e\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 3609 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9812", "caller": "0x7ffbc5455810", "parentcaller": "0x1bcec0cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000103", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xc2\\xf4e\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 3610 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\x96\\xf5e\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00!\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00}\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 3611 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9880", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000508" } ], "repeated": 7, "id": 3612 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9880", "caller": "0x7ffbc54508ee", "parentcaller": "0x7ffbc7298bd7", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000508" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "9452" } ], "repeated": 0, "id": 3613 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9880", "caller": "0x7ffbc549026b", "parentcaller": "0x7ffbc545cbb0", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000508" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000580" } ], "repeated": 0, "id": 3614 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9880", "caller": "0x7ffbc545aa1f", "parentcaller": "0x7ffbc545cb7c", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3615 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9880", "caller": "0x7ffbc545aaa8", "parentcaller": "0x7ffbc545cb7c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x93\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\xa0\\x93\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x93\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\xd4\\x94\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\x94\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xf0\\x94\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x95\\xc9\\xe4\\xbc\\x01\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x18\\x95\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\x95\\xc9\\xe4\\xbc\\x01\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\xf0\\x93\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00v\\x94\\xc9\\xe4\\xbc\\x01\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00|\\x94\\xc9\\xe4\\xbc\\x01\\x00\\x00" } ], "repeated": 0, "id": 3616 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9880", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc545cbbe", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000580" } ], "repeated": 0, "id": 3617 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9880", "caller": "0x7ffbc549026b", "parentcaller": "0x7ffbc545cbb0", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000508" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000580" } ], "repeated": 0, "id": 3618 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9880", "caller": "0x7ffbc545aa1f", "parentcaller": "0x7ffbc545cb7c", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3619 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9880", "caller": "0x7ffbc545aaa8", "parentcaller": "0x7ffbc545cb7c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x93\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\xa0\\x93\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x93\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\xd4\\x94\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\x94\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xf0\\x94\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x95\\xc9\\xe4\\xbc\\x01\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x18\\x95\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\x95\\xc9\\xe4\\xbc\\x01\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\xf0\\x93\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00v\\x94\\xc9\\xe4\\xbc\\x01\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00|\\x94\\xc9\\xe4\\xbc\\x01\\x00\\x00" } ], "repeated": 0, "id": 3620 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9880", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc545cbbe", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000580" } ], "repeated": 0, "id": 3621 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9880", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbb0929183", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000508" } ], "repeated": 0, "id": 3622 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3623 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3624 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3625 }, { "timestamp": "2026-05-28 23:34:33,983", "thread_id": "9880", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3626 }, { "timestamp": "2026-05-28 23:34:33,999", "thread_id": "9880", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc728224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3627 }, { "timestamp": "2026-05-28 23:34:33,999", "thread_id": "9880", "caller": "0x7ffbc7051630", "parentcaller": "0x7ffbc70512cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3628 }, { "timestamp": "2026-05-28 23:34:33,999", "thread_id": "9812", "caller": "0x7ffbc5455810", "parentcaller": "0x1bcec0cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\x06\\x1cf\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00-\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "64" } ], "repeated": 0, "id": 3629 }, { "timestamp": "2026-05-28 23:34:33,999", "thread_id": "9812", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00041000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3630 }, { "timestamp": "2026-05-28 23:34:33,999", "thread_id": "9880", "caller": "0x7ffbc548ebae", "parentcaller": "0x7ffbc5c35b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x8f]D\\x00\\x00\\x00\\xec$\\x00\\x00\\x00\\x00\\x00\\x00\\x98&\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9880" } ], "repeated": 0, "id": 3631 }, { "timestamp": "2026-05-28 23:34:33,999", "thread_id": "9812", "caller": "0x7ffbc5455810", "parentcaller": "0x1bcec0cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000103", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\x06\\x1cf\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00-\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "64" } ], "repeated": 0, "id": 3632 }, { "timestamp": "2026-05-28 23:34:33,999", "thread_id": "9840", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3633 }, { "timestamp": "2026-05-28 23:34:33,999", "thread_id": "9840", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3634 }, { "timestamp": "2026-05-28 23:34:33,999", "thread_id": "9840", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3635 }, { "timestamp": "2026-05-28 23:34:33,999", "thread_id": "9840", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3636 }, { "timestamp": "2026-05-28 23:34:33,999", "thread_id": "9840", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc728224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3637 }, { "timestamp": "2026-05-28 23:34:33,999", "thread_id": "9840", "caller": "0x7ffbc7051630", "parentcaller": "0x7ffbc70512cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3638 }, { "timestamp": "2026-05-28 23:34:33,999", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x0000057c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x7ffbc7272d30" }, { "name": "Parameter", "value": "0x1bce4cb9110" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "10132" }, { "name": "ProcessId", "value": "9452" }, { "name": "Module", "value": "combase.dll" } ], "repeated": 0, "id": 3639 }, { "timestamp": "2026-05-28 23:34:33,999", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x0000057c", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffbc7272d30" }, { "name": "Parameter", "value": "0x1bce4cb9110" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "10132" }, { "name": "ProcessId", "value": "9452" } ], "repeated": 0, "id": 3640 }, { "timestamp": "2026-05-28 23:34:33,999", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000057c" } ], "repeated": 0, "id": 3641 }, { "timestamp": "2026-05-28 23:34:33,999", "thread_id": "10132", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4ce9000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3642 }, { "timestamp": "2026-05-28 23:34:33,999", "thread_id": "10132", "caller": "0x7ffbc7b72caa", "parentcaller": "0x7ffbc7b72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4c7d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3643 }, { "timestamp": "2026-05-28 23:34:33,999", "thread_id": "10132", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438800228000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3644 }, { "timestamp": "2026-05-28 23:34:33,999", "thread_id": "10132", "caller": "0x7ffbc5474448", "parentcaller": "0x1bceb2ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c0005c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3645 }, { "timestamp": "2026-05-28 23:34:33,999", "thread_id": "10132", "caller": "0x7ffbc7bc507d", "parentcaller": "0x7ffbc7bc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3646 }, { "timestamp": "2026-05-28 23:34:33,999", "thread_id": "10132", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ffbc7272d30" }, { "name": "Parameter", "value": "0x1bce4cb9110" } ], "repeated": 0, "id": 3647 }, { "timestamp": "2026-05-28 23:34:33,999", "thread_id": "10132", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc703ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000580" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 3648 }, { "timestamp": "2026-05-28 23:34:33,999", "thread_id": "10132", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7272ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000588" } ], "repeated": 0, "id": 3649 }, { "timestamp": "2026-05-28 23:34:33,999", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3650 }, { "timestamp": "2026-05-28 23:34:33,999", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "Milliseconds", "value": "4634" } ], "repeated": 0, "id": 3651 }, { "timestamp": "2026-05-28 23:34:34,014", "thread_id": "9840", "caller": "0x7ffbc548ebae", "parentcaller": "0x7ffbc5c3712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x8f]D\\x00\\x00\\x00\\xec$\\x00\\x00\\x00\\x00\\x00\\x00p&\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9840" } ], "repeated": 0, "id": 3652 }, { "timestamp": "2026-05-28 23:34:34,014", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000057c" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000344" }, { "name": "ObjectAttributesName", "value": "Windows.Storage.ApplicationData" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData" } ], "repeated": 0, "id": 3653 }, { "timestamp": "2026-05-28 23:34:34,014", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000057c" }, { "name": "KeyInformation", "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00>\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00t\\x00o\\x00r\\x00a\\x00g\\x00e\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00D\\x00a\\x00t\\x00a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EM\\xffc7\\xfffb\\x7f\\x00\\x00\\xfff8\\xff98\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffc9r]D\\x00\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x0008\\xffce\\xffe4\\xffbc\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x00\\xffa4!A\\xffbfP\\xffe2\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff95\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00\\xfff8\\xff98\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\xffd0\\xff98\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d!\\xffc7\\xfffb\\x7f\\x00\\x0008\\xffce\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff98\\xffc8\\xffe4\\xffbc\\x01\\x00\\x0008\\xffce\\xffe4\\xffbc\\x01\\x00\\x00P\\xff95\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00`Y\\xffce\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s!\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff95\\xffcb\\xffe4\\xffbc\\x01\\x00\\x00\\xfff0\\xff99\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\xfff0\\xff99\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0008\\xffce\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xff99\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\xff8c\\xffc2\\xffb7\\xffc7\\xfffb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffbc\\x01\\x00\\x0008\\xffce\\xffe4\\xffbc\\x01\\x00\\x00`Y\\xffce\\xffe4\\xffbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffcar]D\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xff93\\xffca\\xffe4\\xffbc\\x01\\x00\\x00\\xffd0\\xff98\\xffc8\\xffe4\\xffbc\\x01\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 3654 }, { "timestamp": "2026-05-28 23:34:34,014", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000057c" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivationType" } ], "repeated": 0, "id": 3655 }, { "timestamp": "2026-05-28 23:34:34,014", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000057c" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Server" } ], "repeated": 0, "id": 3656 }, { "timestamp": "2026-05-28 23:34:34,014", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000057c" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\Windows.Storage.ApplicationData.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\DllPath" } ], "repeated": 0, "id": 3657 }, { "timestamp": "2026-05-28 23:34:34,014", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000057c" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Threading" } ], "repeated": 0, "id": 3658 }, { "timestamp": "2026-05-28 23:34:34,014", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000057c" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\TrustLevel" } ], "repeated": 0, "id": 3659 }, { "timestamp": "2026-05-28 23:34:34,014", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000057c" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\CustomAttributes" } ], "repeated": 0, "id": 3660 }, { "timestamp": "2026-05-28 23:34:34,014", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000057c" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\RemoteServer" } ], "repeated": 0, "id": 3661 }, { "timestamp": "2026-05-28 23:34:34,014", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000057c" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateAsUser" } ], "repeated": 0, "id": 3662 }, { "timestamp": "2026-05-28 23:34:34,014", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000057c" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInSharedBroker" } ], "repeated": 0, "id": 3663 }, { "timestamp": "2026-05-28 23:34:34,014", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000057c" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 3664 }, { "timestamp": "2026-05-28 23:34:34,014", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000057c" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Permissions" } ], "repeated": 0, "id": 3665 }, { "timestamp": "2026-05-28 23:34:34,014", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000057c" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3666 }, { "timestamp": "2026-05-28 23:34:34,014", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000057c" } ], "repeated": 0, "id": 3667 }, { "timestamp": "2026-05-28 23:34:34,014", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.Storage.ApplicationData" }, { "name": "DllBase", "value": "0x7ffbac570000" } ], "repeated": 0, "id": 3668 }, { "timestamp": "2026-05-28 23:34:34,014", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\Windows.Storage.ApplicationData.dll" }, { "name": "BaseAddress", "value": "0x7ffbac570000" } ], "repeated": 0, "id": 3669 }, { "timestamp": "2026-05-28 23:34:34,014", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbac570000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\Windows.Storage.ApplicationData.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 3670 }, { "timestamp": "2026-05-28 23:34:34,014", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "ModuleHandle", "value": "0x7ffbac570000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbac594340" } ], "repeated": 0, "id": 3671 }, { "timestamp": "2026-05-28 23:34:34,014", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "ModuleHandle", "value": "0x7ffbac570000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbac5820a0" } ], "repeated": 0, "id": 3672 }, { "timestamp": "2026-05-28 23:34:34,014", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "ModuleHandle", "value": "0x7ffbac570000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbac5840a0" } ], "repeated": 0, "id": 3673 }, { "timestamp": "2026-05-28 23:34:34,014", "thread_id": "10132", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7272ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000588" } ], "repeated": 0, "id": 3674 }, { "timestamp": "2026-05-28 23:34:34,014", "thread_id": "10132", "caller": "0x7ffbc7b97830", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbac5d2000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3675 }, { "timestamp": "2026-05-28 23:34:34,014", "thread_id": "10132", "caller": "0x7ffbc7b97881", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbac5d2000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3676 }, { "timestamp": "2026-05-28 23:34:34,014", "thread_id": "10132", "caller": "0x7ffbc7b97830", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbac5d2000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3677 }, { "timestamp": "2026-05-28 23:34:34,014", "thread_id": "10132", "caller": "0x7ffbc7b97881", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbac5d2000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3678 }, { "timestamp": "2026-05-28 23:34:34,014", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xd2r]D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3679 }, { "timestamp": "2026-05-28 23:34:34,014", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbac5d2000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3680 }, { "timestamp": "2026-05-28 23:34:34,014", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbac5d2000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3681 }, { "timestamp": "2026-05-28 23:34:34,014", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x0000059c" }, { "name": "MutexName", "value": "Local\\SM0:9452:120:WilError_03" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 3682 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000059c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3683 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3684 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3685 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3686 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a4" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3687 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a4" } ], "repeated": 0, "id": 3688 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a0" } ], "repeated": 0, "id": 3689 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000059c" } ], "repeated": 0, "id": 3690 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000059c" } ], "repeated": 0, "id": 3691 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbac5d2000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3692 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbac5d2000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3693 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3694 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbac5d2000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3695 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbac5d2000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3696 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x0000059c" } ], "repeated": 0, "id": 3697 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3698 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000059c" } ], "repeated": 0, "id": 3699 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 3700 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005a0" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER" }, { "name": "ObjectAttributes", "value": "HKEY_USERS" } ], "repeated": 0, "id": 3701 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 3702 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005a0" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3703 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005a4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000005a0" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\SystemAppData\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\PSR" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\SystemAppData\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\PSR" } ], "repeated": 0, "id": 3704 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a4" }, { "name": "ValueName", "value": "WnfStateName" }, { "name": "Data", "value": "\\xe5\\xd0\\xbd\\xa3mN\\xc6A" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\SystemAppData\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\PSR\\WnfStateName" } ], "repeated": 0, "id": 3705 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a4" } ], "repeated": 0, "id": 3706 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3707 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005a0" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3708 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000005a0" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 3709 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a4" }, { "name": "ValueName", "value": "Local AppData" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData" } ], "repeated": 0, "id": 3710 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a4" }, { "name": "ValueName", "value": "Local AppData" }, { "name": "Data", "value": "%USERPROFILE%\\AppData\\Local" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData" } ], "repeated": 0, "id": 3711 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3712 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000110" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3713 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000588" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000110" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 3714 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000588" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 3715 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000588" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Data", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 3716 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000588" } ], "repeated": 0, "id": 3717 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a4" } ], "repeated": 0, "id": 3718 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbac5d2000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3719 }, { "timestamp": "2026-05-28 23:34:34,030", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbac5d2000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3720 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbac5d2000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3721 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbac5d2000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3722 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3723 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3724 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3725 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3726 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3727 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3728 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc5c12000" }, { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3729 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc5c12000" }, { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3730 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000058c" }, { "name": "DesiredAccess", "value": "0x00000006" }, { "name": "ObjectAttributes", "value": "windows_shell_global_counters" } ], "repeated": 0, "id": 3731 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000058c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce95e0000" }, { "name": "SectionOffset", "value": "0x445d72c860" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3732 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc5c12000" }, { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3733 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc5c12000" }, { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3734 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000005a4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3735 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005a4" }, { "name": "ValueName", "value": "NoPropertiesMyComputer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesMyComputer" } ], "repeated": 0, "id": 3736 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a4" } ], "repeated": 0, "id": 3737 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3738 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000588" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3739 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000588" }, { "name": "ValueName", "value": "NoPropertiesRecycleBin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesRecycleBin" } ], "repeated": 0, "id": 3740 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000588" } ], "repeated": 0, "id": 3741 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3742 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3743 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3744 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" } ], "repeated": 0, "id": 3745 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7b593b0" } ], "repeated": 0, "id": 3746 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7befc40" } ], "repeated": 0, "id": 3747 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7b92460" } ], "repeated": 0, "id": 3748 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bcfa30" } ], "repeated": 0, "id": 3749 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bacbd0" } ], "repeated": 0, "id": 3750 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bb3410" } ], "repeated": 0, "id": 3751 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000588" }, { "name": "MutexName", "value": "Local\\SM0:9452:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 3752 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000588" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3753 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3754 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000590" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3755 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3756 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3757 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a8" } ], "repeated": 0, "id": 3758 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000590" } ], "repeated": 0, "id": 3759 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000588" } ], "repeated": 0, "id": 3760 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000588" } ], "repeated": 0, "id": 3761 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000588" }, { "name": "MutexName", "value": "Local\\SM0:9452:120:WilError_03" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 3762 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000588" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3763 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3764 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000590" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3765 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3766 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3767 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a8" } ], "repeated": 0, "id": 3768 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000590" } ], "repeated": 0, "id": 3769 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000588" } ], "repeated": 0, "id": 3770 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000588" } ], "repeated": 0, "id": 3771 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000588" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3772 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000588" }, { "name": "ValueName", "value": "NoControlPanel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" } ], "repeated": 0, "id": 3773 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000588" } ], "repeated": 0, "id": 3774 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3775 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000588" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3776 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000588" }, { "name": "ValueName", "value": "NoSetFolders" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSetFolders" } ], "repeated": 0, "id": 3777 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000588" } ], "repeated": 0, "id": 3778 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3779 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000588" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3780 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000588" }, { "name": "ValueName", "value": "NoInternetIcon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoInternetIcon" } ], "repeated": 0, "id": 3781 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000588" } ], "repeated": 0, "id": 3782 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3783 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\identity_helper.exe" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\identity_helper.exe" } ], "repeated": 0, "id": 3784 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3785 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000110" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3786 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000588" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000110" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 3787 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000588" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 3788 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000588" } ], "repeated": 0, "id": 3789 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3790 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000110" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3791 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000588" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000110" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 3792 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000588" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 3793 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000588" } ], "repeated": 0, "id": 3794 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3795 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3796 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000588" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3797 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000588" }, { "name": "ValueName", "value": "NoCommonGroups" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoCommonGroups" } ], "repeated": 0, "id": 3798 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000588" } ], "repeated": 0, "id": 3799 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3800 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3801 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3802 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3803 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3804 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder" }, { "name": "Handle", "value": "0x000005b2" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder" } ], "repeated": 0, "id": 3805 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3806 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3807 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005b2" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\Attributes" } ], "repeated": 0, "id": 3808 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005b2" }, { "name": "ValueName", "value": "CallForAttributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\CallForAttributes" } ], "repeated": 0, "id": 3809 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005b2" }, { "name": "ValueName", "value": "RestrictedAttributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\RestrictedAttributes" } ], "repeated": 0, "id": 3810 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b2" }, { "name": "ValueName", "value": "FolderValueFlags" }, { "name": "Data", "value": "1581568" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\FolderValueFlags" } ], "repeated": 0, "id": 3811 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b2" } ], "repeated": 0, "id": 3812 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3813 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3814 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder" } ], "repeated": 0, "id": 3815 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder" } ], "repeated": 0, "id": 3816 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" } ], "repeated": 0, "id": 3817 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" }, { "name": "Handle", "value": "0x000005b0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" } ], "repeated": 0, "id": 3818 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005b0" }, { "name": "ValueName", "value": "{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 3819 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b0" } ], "repeated": 0, "id": 3820 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3821 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000110" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3822 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005b0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000110" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 3823 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005b0" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 3824 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b0" } ], "repeated": 0, "id": 3825 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3826 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000110" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3827 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005b0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000110" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 3828 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005b0" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 3829 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b0" } ], "repeated": 0, "id": 3830 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3831 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3832 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3833 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3834 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" } ], "repeated": 0, "id": 3835 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlAreLongPathsEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bc5280" } ], "repeated": 0, "id": 3836 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbac5d2000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3837 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbac5d2000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3838 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc6457000" }, { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3839 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc6457000" }, { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3840 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bcfa30" } ], "repeated": 0, "id": 3841 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x000005b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 3842 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005b4" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 3843 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b4" } ], "repeated": 0, "id": 3844 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7b593b0" } ], "repeated": 0, "id": 3845 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7befc40" } ], "repeated": 0, "id": 3846 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7b92460" } ], "repeated": 0, "id": 3847 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4cea000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3848 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4ceb000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3849 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bacbd0" } ], "repeated": 0, "id": 3850 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000588" }, { "name": "MutexName", "value": "Local\\SM0:9452:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 3851 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000588" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3852 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3853 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000590" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3854 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3855 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3856 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a8" } ], "repeated": 0, "id": 3857 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000590" } ], "repeated": 0, "id": 3858 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000588" } ], "repeated": 0, "id": 3859 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000588" } ], "repeated": 0, "id": 3860 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000590" } ], "repeated": 0, "id": 3861 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 3862 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 3863 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000590" } ], "repeated": 0, "id": 3864 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Directory" }, { "name": "Handle", "value": "0x00000592" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Directory" } ], "repeated": 0, "id": 3865 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000592" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Directory" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3866 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000592" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 3867 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000592" }, { "name": "ObjectAttributesName", "value": "ShellEx\\LibraryDescriptionHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\ShellEx\\LibraryDescriptionHandler" } ], "repeated": 0, "id": 3868 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\Directory\\ShellEx\\LibraryDescriptionHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Directory\\ShellEx\\LibraryDescriptionHandler" } ], "repeated": 0, "id": 3869 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Folder" }, { "name": "Handle", "value": "0x000005ba" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Folder" } ], "repeated": 0, "id": 3870 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005ba" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\Folder" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3871 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005ba" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3872 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xc2r]D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00\\xba\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00@\\xc3r]D\\x00\\x00\\x00" } ], "repeated": 0, "id": 3873 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Folder\\ShellEx\\LibraryDescriptionHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Folder\\ShellEx\\LibraryDescriptionHandler" } ], "repeated": 0, "id": 3874 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005ba" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3875 }, { "timestamp": "2026-05-28 23:34:34,045", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000005ba" }, { "name": "ObjectAttributesName", "value": "ShellEx\\LibraryDescriptionHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\LibraryDescriptionHandler" } ], "repeated": 0, "id": 3876 }, { "timestamp": "2026-05-28 23:34:34,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "AllFilesystemObjects" }, { "name": "Handle", "value": "0x000005be" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\AllFilesystemObjects" } ], "repeated": 0, "id": 3877 }, { "timestamp": "2026-05-28 23:34:34,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005be" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3878 }, { "timestamp": "2026-05-28 23:34:34,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005be" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3879 }, { "timestamp": "2026-05-28 23:34:34,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xc2r]D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00\\xbe\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00@\\xc3r]D\\x00\\x00\\x00" } ], "repeated": 0, "id": 3880 }, { "timestamp": "2026-05-28 23:34:34,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\AllFilesystemObjects\\ShellEx\\LibraryDescriptionHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AllFilesystemObjects\\ShellEx\\LibraryDescriptionHandler" } ], "repeated": 0, "id": 3881 }, { "timestamp": "2026-05-28 23:34:34,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005be" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3882 }, { "timestamp": "2026-05-28 23:34:34,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000005be" }, { "name": "ObjectAttributesName", "value": "ShellEx\\LibraryDescriptionHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\LibraryDescriptionHandler" } ], "repeated": 0, "id": 3883 }, { "timestamp": "2026-05-28 23:34:34,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000592" } ], "repeated": 0, "id": 3884 }, { "timestamp": "2026-05-28 23:34:34,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ba" } ], "repeated": 0, "id": 3885 }, { "timestamp": "2026-05-28 23:34:34,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005be" } ], "repeated": 0, "id": 3886 }, { "timestamp": "2026-05-28 23:34:34,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x7ffbc34267d0" }, { "name": "EventName", "value": "Global\\WSearchMigPluginActive" } ], "repeated": 0, "id": 3887 }, { "timestamp": "2026-05-28 23:34:34,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3888 }, { "timestamp": "2026-05-28 23:34:34,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3889 }, { "timestamp": "2026-05-28 23:34:34,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x8d]D\\x00\\x00\\x00\\xec$\\x00\\x00\\x00\\x00\\x00\\x00\\xf0$\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9456" } ], "repeated": 0, "id": 3890 }, { "timestamp": "2026-05-28 23:34:34,061", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000590" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3891 }, { "timestamp": "2026-05-28 23:34:34,061", "thread_id": "9840", "caller": "0x7ffbc548ebae", "parentcaller": "0x7ffbc5c684de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x8f]D\\x00\\x00\\x00\\xec$\\x00\\x00\\x00\\x00\\x00\\x00p&\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9840" } ], "repeated": 0, "id": 3892 }, { "timestamp": "2026-05-28 23:34:34,061", "thread_id": "9840", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc728224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3893 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9840", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\mssprxy" }, { "name": "DllBase", "value": "0x7ffbb55b0000" } ], "repeated": 0, "id": 3894 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9840", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\mssprxy.dll" }, { "name": "BaseAddress", "value": "0x7ffbb55b0000" } ], "repeated": 0, "id": 3895 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9840", "caller": "0x7ffbc34d8e8e", "parentcaller": "0x7ffbc34df5f2", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "7D096C5F-AC08-4F1F-BEB7-5C22C517CE39" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "AB310581-AC80-11D1-8DF3-00C04FB6EF69" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3896 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9840", "caller": "0x7ffbc7b93f7a", "parentcaller": "0x7ffbc7020ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3897 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9840", "caller": "0x7ffbc72022bf", "parentcaller": "0x7ffbc727fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}" }, { "name": "Handle", "value": "0x000005ca" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}" } ], "repeated": 0, "id": 3898 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9840", "caller": "0x7ffbc727fa51", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005ca" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x000005ce" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}\\ProxyStubClsid32" } ], "repeated": 0, "id": 3899 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9840", "caller": "0x7ffbc727fa8c", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ce" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{A5EBA07A-DAE8-4d15-B12F-728EFD8A9866}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 3900 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9840", "caller": "0x7ffbc727fad3", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ce" } ], "repeated": 0, "id": 3901 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9840", "caller": "0x7ffbc727fae4", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ca" } ], "repeated": 0, "id": 3902 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9840", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3903 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9840", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3904 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9840", "caller": "0x7ffbc72022bf", "parentcaller": "0x7ffbc727fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}" }, { "name": "Handle", "value": "0x000005aa" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}" } ], "repeated": 0, "id": 3905 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9840", "caller": "0x7ffbc727fa51", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005aa" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x000005d2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}\\ProxyStubClsid32" } ], "repeated": 0, "id": 3906 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9840", "caller": "0x7ffbc727fa8c", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{A5EBA07A-DAE8-4d15-B12F-728EFD8A9866}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 3907 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9840", "caller": "0x7ffbc727fad3", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d2" } ], "repeated": 0, "id": 3908 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9840", "caller": "0x7ffbc727fae4", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005aa" } ], "repeated": 0, "id": 3909 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9840", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3910 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9840", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3911 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9840", "caller": "0x7ffbc548ebae", "parentcaller": "0x7ffbc5c3712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x8f]D\\x00\\x00\\x00\\xec$\\x00\\x00\\x00\\x00\\x00\\x00p&\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9840" } ], "repeated": 0, "id": 3912 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3913 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3914 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc0e9f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3915 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc0e9f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3916 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc0e9f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3917 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc0e9f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3918 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc0e9f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3919 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc0e9f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3920 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\propsys.dll" }, { "name": "BaseAddress", "value": "0x7ffbc0db0000" } ], "repeated": 0, "id": 3921 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "76765B11-3F95-4AF2-AC9D-EA55D8994F1A" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3922 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc0e9f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3923 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc0e9f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3924 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "1F486A52-3CB1-48FD-8F50-B8DC300D9F9D" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ECF31D61-E474-453C-BEE7-DE68E441C6D0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3925 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4cef000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3926 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4cf0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3927 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4cf1000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3928 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" } ], "repeated": 0, "id": 3929 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bcfa30" } ], "repeated": 0, "id": 3930 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce9702000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3931 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2" } ], "repeated": 0, "id": 3932 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Local\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2" } ], "repeated": 0, "id": 3933 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005c0" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro" } ], "repeated": 0, "id": 3934 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005c0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce95f0000" }, { "name": "SectionOffset", "value": "0x445d72b9f0" }, { "name": "ViewSize", "value": "0x00004000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3935 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005bc" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db" } ], "repeated": 0, "id": 3936 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005bc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce9e50000" }, { "name": "SectionOffset", "value": "0x445d72c950" }, { "name": "ViewSize", "value": "0x00049000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3937 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc0e9f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3938 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc0e9f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3939 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\propsys.dll" } ], "repeated": 1, "id": 3940 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\propsys.dll" } ], "repeated": 0, "id": 3941 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce9704000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3942 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce9705000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3943 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2" } ], "repeated": 0, "id": 3944 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Local\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2" } ], "repeated": 0, "id": 3945 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005a8" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro" } ], "repeated": 0, "id": 3946 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005a8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce9ea0000" }, { "name": "SectionOffset", "value": "0x445d72baa0" }, { "name": "ViewSize", "value": "0x00004000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3947 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005d0" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" } ], "repeated": 0, "id": 3948 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005d0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce9eb0000" }, { "name": "SectionOffset", "value": "0x445d72ca00" }, { "name": "ViewSize", "value": "0x0009c000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3949 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\propsys.dll" } ], "repeated": 1, "id": 3950 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\propsys.dll" } ], "repeated": 0, "id": 3951 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3952 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3953 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3954 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4cf3000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3955 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x90/\\xcf\\xe4\\xbc\\x01\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x0000\\xcf\\xe4\\xbc\\x01\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00P0\\xcf\\xe4\\xbc\\x01\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00d1\\xcf\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00x1\\xcf\\xe4\\xbc\\x01\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x801\\xcf\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa01\\xcf\\xe4\\xbc\\x01\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xa81\\xcf\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc81\\xcf\\xe4\\xbc\\x01\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\x800\\xcf\\xe4\\xbc\\x01\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x061\\xcf\\xe4\\xbc\\x01\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\x0c1\\xcf\\xe4\\xbc\\x01\\x00\\x00" } ], "repeated": 0, "id": 3956 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3957 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x90/\\xcf\\xe4\\xbc\\x01\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x0000\\xcf\\xe4\\xbc\\x01\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00P0\\xcf\\xe4\\xbc\\x01\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00d1\\xcf\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00x1\\xcf\\xe4\\xbc\\x01\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x801\\xcf\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa01\\xcf\\xe4\\xbc\\x01\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xa81\\xcf\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc81\\xcf\\xe4\\xbc\\x01\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\x800\\xcf\\xe4\\xbc\\x01\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x061\\xcf\\xe4\\xbc\\x01\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\x0c1\\xcf\\xe4\\xbc\\x01\\x00\\x00" } ], "repeated": 0, "id": 3958 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3959 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3960 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3961 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xf4\\xcc\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x11\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 3962 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x000005c8" } ], "repeated": 0, "id": 3963 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3964 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" } ], "repeated": 0, "id": 3965 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3966 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005a0" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3967 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005c8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000005a0" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 3968 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "Local AppData" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData" } ], "repeated": 0, "id": 3969 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "Local AppData" }, { "name": "Data", "value": "%USERPROFILE%\\AppData\\Local" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData" } ], "repeated": 0, "id": 3970 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3971 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000110" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3972 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005cc" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000110" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 3973 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 3974 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Data", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 3975 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 3976 }, { "timestamp": "2026-05-28 23:34:34,077", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" } ], "repeated": 0, "id": 3977 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3978 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000110" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3979 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005b8" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000110" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Appx" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Appx" } ], "repeated": 0, "id": 3980 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b8" }, { "name": "ValueName", "value": "PackageRepositoryRoot" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot" } ], "repeated": 0, "id": 3981 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b8" }, { "name": "ValueName", "value": "PackageRepositoryRoot" }, { "name": "Data", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot" } ], "repeated": 0, "id": 3982 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b8" } ], "repeated": 0, "id": 3983 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3984 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000110" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3985 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005b8" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000110" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Appx" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Appx" } ], "repeated": 0, "id": 3986 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b8" }, { "name": "ValueName", "value": "PackageRepositoryRoot" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot" } ], "repeated": 0, "id": 3987 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b8" }, { "name": "ValueName", "value": "PackageRepositoryRoot" }, { "name": "Data", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot" } ], "repeated": 0, "id": 3988 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b8" } ], "repeated": 0, "id": 3989 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4cf6000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3990 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3991 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005b8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3992 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005b8" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x10\\xbbr]D\\x00\\x00\\x00@\\xbbr]D\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xff\\xf8\\x97\\x16\\xf2]\n\\x00\\x00\\x08\\x82h\\x86\\xfb\\x7f\\x00\\x00\\xd0\\xa5\\xce\\xe4\\xbc\\x01\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00@L\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xbbr]D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfakE\\xc5\\xfb\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xbbr]D\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00`\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x00\\xb0\\x00D\\x00\\x00\\x00\\xd0\\xa5\\xce\\xe4\\xbc\\x01\\x00\\x00\\xd5,\\xb7\\xc7\\xfb\\x7f\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xa9\\xbbr]D\\x00\\x00\\x000\\x00\\x00\\x00D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xbbr]D\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3993 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b8" } ], "repeated": 0, "id": 3994 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005b8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3995 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b8" } ], "repeated": 0, "id": 3996 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005b8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3997 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005b8" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "" } ], "repeated": 0, "id": 3998 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b8" } ], "repeated": 0, "id": 3999 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005b8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4000 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005b8" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "" } ], "repeated": 0, "id": 4001 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b8" } ], "repeated": 0, "id": 4002 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 4003 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005b8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4004 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005b8" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x10\\xbbr]D\\x00\\x00\\x00@\\xbbr]D\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xff\\xf8\\x97\\x16\\xf2]\n\\x00\\x00\\x08\\x82h\\x86\\xfb\\x7f\\x00\\x00\\xb06\\xce\\xe4\\xbc\\x01\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00@L\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xbbr]D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfakE\\xc5\\xfb\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xbbr]D\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00R\\x00V\\x00\\x00\\x00\\x00\\x00\\xb06\\xce\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xbbr]D\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4005 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b8" } ], "repeated": 0, "id": 4006 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005b8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 4007 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b8" } ], "repeated": 0, "id": 4008 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005b8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 4009 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005b8" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x00\\x00\\x0ci\\x00\\x00\\x00\\x00\\x00\\x00i\\xe6\\xbc\\x01\\x00\\x00u\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9LD\\x86\\xfb\\x7f\\x00\\x00\\xdaxXv\\x01\\x00\\x00\\x00\\xfeYE\\xc5\\xfb\\x7f\\x00\\x00\\x87\\x00 \\x88\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x00 \\x88\\xfb\\x7f\\x00\\x00\\xf8\\xber]D\\x00\\x00\\x00`\\x11F\\x86\\xfb\\x7f\\x00\\x00\\xcdG\\xb7\\xc7\\xfb\\x7f\\x00\\x00\\x08\\xael\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00\\xb8\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xa8g\\x86\\xfb\\x7f\\x00\\x00z{Xv\r\\x8a\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00&\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\x05\\x00\\x00\\x00\\x00\\x00\\x00@L\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xbc+E\\x86\\xfb\\x7f\\x00\\x00P\\xba\\x80\\xe6\\xbc\\x01\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\x05\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4010 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b8" } ], "repeated": 0, "id": 4011 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005b8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4012 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005b8" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "" } ], "repeated": 0, "id": 4013 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b8" } ], "repeated": 0, "id": 4014 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 4015 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005cc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4016 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005cc" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x10\\xbbr]D\\x00\\x00\\x00@\\xbbr]D\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xff\\xf8\\x97\\x16\\xf2]\n\\x00\\x00\\x08\\x82h\\x86\\xfb\\x7f\\x00\\x00\\xa0P\\xce\\xe4\\xbc\\x01\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00@L\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xbbr]D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfakE\\xc5\\xfb\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xbbr]D\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00D\\x00\\x00\\x00\\x00\\x00\\xa0P\\xce\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xbbr]D\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4017 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 4018 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005cc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 4019 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 4020 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005cc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 4021 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005cc" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x00\\x00\\x8ci\\x00\\x00\\x00\\x00\\x00\\x00i\\xe6\\xbc\\x01\\x00\\x00u\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9LD\\x86\\xfb\\x7f\\x00\\x00\\xdaxXv\\x01\\x00\\x00\\x00\\xfeYE\\xc5\\xfb\\x7f\\x00\\x00\\x87\\x00 \\x88\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x00 \\x88\\xfb\\x7f\\x00\\x00\\xf8\\xber]D\\x00\\x00\\x00`\\x11F\\x86\\xfb\\x7f\\x00\\x00\\xcdG\\xb7\\xc7\\xfb\\x7f\\x00\\x00\\x08\\xael\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00\\xb8\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xa8g\\x86\\xfb\\x7f\\x00\\x00z{Xv\r\\x8a\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00&\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\x05\\x00\\x00\\x00\\x00\\x00\\x00@L\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xbc+E\\x86\\xfb\\x7f\\x00\\x00P\\xba\\x80\\xe6\\xbc\\x01\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\x05\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4022 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 4023 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005cc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4024 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005cc" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "" } ], "repeated": 0, "id": 4025 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 4026 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 4027 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005cc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4028 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005cc" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x10\\xbbr]D\\x00\\x00\\x00@\\xbbr]D\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xff\\xf8\\x97\\x16\\xf2]\n\\x00\\x00\\x08\\x82h\\x86\\xfb\\x7f\\x00\\x00\\xd0\\xc0\\xce\\xe4\\xbc\\x01\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00@L\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xbbr]D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfakE\\xc5\\xfb\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xbbr]D\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x004\\x008\\x00\\x00\\x00\\x00\\x00\\xd0\\xc0\\xce\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xbbr]D\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4029 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 4030 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005cc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 4031 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 4032 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005cc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 4033 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005cc" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x00\\x00lj\\x00\\x00\\x00\\x00\\x00\\x00i\\xe6\\xbc\\x01\\x00\\x00u\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9LD\\x86\\xfb\\x7f\\x00\\x00\\xdaxXv\\x01\\x00\\x00\\x00\\xfeYE\\xc5\\xfb\\x7f\\x00\\x00\\x87\\x00 \\x88\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x00 \\x88\\xfb\\x7f\\x00\\x00\\xf8\\xber]D\\x00\\x00\\x00`\\x11F\\x86\\xfb\\x7f\\x00\\x00\\xcdG\\xb7\\xc7\\xfb\\x7f\\x00\\x00\\x08\\xael\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00\\xcc\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xa8g\\x86\\xfb\\x7f\\x00\\x00z{Xv\r\\x8a\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00&\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xcc\\x05\\x00\\x00\\x00\\x00\\x00\\x00@L\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xbc+E\\x86\\xfb\\x7f\\x00\\x00P\\xba\\x80\\xe6\\xbc\\x01\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xcc\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xcc\\x05\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4034 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 4035 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005cc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4036 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005cc" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "" } ], "repeated": 0, "id": 4037 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 4038 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 4039 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005cc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4040 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005cc" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x10\\xbbr]D\\x00\\x00\\x00@\\xbbr]D\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xff\\xf8\\x97\\x16\\xf2]\n\\x00\\x00\\x08\\x82h\\x86\\xfb\\x7f\\x00\\x00p\\xf4\\xcc\\xe4\\xbc\\x01\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00@L\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xbbr]D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfakE\\xc5\\xfb\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xbbr]D\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x00(\\x00\\x00\\x00\\x00\\x00p\\xf4\\xcc\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xbbr]D\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4041 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 4042 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005cc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 4043 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 4044 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005cc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 4045 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005cc" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x00\\x00\\x8ck\\x00\\x00\\x00\\x00\\x00\\x00i\\xe6\\xbc\\x01\\x00\\x00u\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9LD\\x86\\xfb\\x7f\\x00\\x00\\xdaxXv\\x01\\x00\\x00\\x00\\xfeYE\\xc5\\xfb\\x7f\\x00\\x00\\x87\\x00 \\x88\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x00 \\x88\\xfb\\x7f\\x00\\x00\\xf8\\xber]D\\x00\\x00\\x00`\\x11F\\x86\\xfb\\x7f\\x00\\x00\\xcdG\\xb7\\xc7\\xfb\\x7f\\x00\\x00\\x08\\xael\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00\\xcc\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xa8g\\x86\\xfb\\x7f\\x00\\x00z{Xv\r\\x8a\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00&\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xcc\\x05\\x00\\x00\\x00\\x00\\x00\\x00@L\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xbc+E\\x86\\xfb\\x7f\\x00\\x00P\\xba\\x80\\xe6\\xbc\\x01\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xcc\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xcc\\x05\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4046 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 4047 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005cc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4048 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005cc" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "" } ], "repeated": 0, "id": 4049 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 4050 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 4051 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005cc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4052 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005cc" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x10\\xbbr]D\\x00\\x00\\x00@\\xbbr]D\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xff\\xf8\\x97\\x16\\xf2]\n\\x00\\x00\\x08\\x82h\\x86\\xfb\\x7f\\x00\\x00\\xc0\\x95\\xce\\xe4\\xbc\\x01\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00@L\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xbbr]D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfakE\\xc5\\xfb\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xbbr]D\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\xc0\\x95\\xce\\xe4\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xbbr]D\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4053 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 4054 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005cc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 4055 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 4056 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005cc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 4057 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005cc" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x00\\x00\\xacl\\x00\\x00\\x00\\x00\\x00\\x00i\\xe6\\xbc\\x01\\x00\\x00u\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9LD\\x86\\xfb\\x7f\\x00\\x00\\xdaxXv\\x01\\x00\\x00\\x00\\xfeYE\\xc5\\xfb\\x7f\\x00\\x00\\x87\\x00 \\x88\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x00 \\x88\\xfb\\x7f\\x00\\x00\\xf8\\xber]D\\x00\\x00\\x00`\\x11F\\x86\\xfb\\x7f\\x00\\x00\\xcdG\\xb7\\xc7\\xfb\\x7f\\x00\\x00\\x08\\xael\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00\\xcc\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xa8g\\x86\\xfb\\x7f\\x00\\x00z{Xv\r\\x8a\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00&\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xcc\\x05\\x00\\x00\\x00\\x00\\x00\\x00@L\\xc8\\xe4\\xbc\\x01\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xbc+E\\x86\\xfb\\x7f\\x00\\x00P\\xba\\x80\\xe6\\xbc\\x01\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xcc\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xcc\\x05\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4058 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 4059 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005cc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4060 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005cc" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "" } ], "repeated": 0, "id": 4061 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 4062 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005cc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 4063 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x000005cc" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00" } ], "repeated": 0, "id": 4064 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 4065 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005cc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4066 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005cc" }, { "name": "IoControlCode", "value": "0x006d0008", "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS" }, { "name": "InBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00" }, { "name": "OutBuffer", "value": "\\xee\\x00\\x00\\x00\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 4067 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x000005cc" }, { "name": "IoControlCode", "value": "0x006d0008", "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS" }, { "name": "InBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00" }, { "name": "OutBuffer", "value": "\\xee\\x00\\x00\\x00\\x02\\x00\\x00\\x00r\\x00\\x00\\x00\\x1c\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00\\x8e\\x00\\x00\\x00`\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00/\\x10\\x8cR\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\\\x00D\\x00o\\x00s\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00s\\x00\\\\x00C\\x00:\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00" } ], "repeated": 0, "id": 4068 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 4069 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "GetVolumeNameForVolumeMountPointW", "status": true, "return": "0x00000001", "arguments": [ { "name": "VolumeMountPoint", "value": "C:\\" }, { "name": "VolumeName", "value": "\\\\?\\Volume{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 4070 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000005cc" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 4071 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005cc" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000005d4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 4072 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 4073 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d4" }, { "name": "ValueName", "value": "Data" }, { "name": "Data", "value": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xbaA\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00t6L\\xb3\\x1f\\x00\\x00\\x00\\x04@\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x003\\x003\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Data" } ], "repeated": 0, "id": 4074 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d4" } ], "repeated": 0, "id": 4075 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000005d4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 4076 }, { "timestamp": "2026-05-28 23:34:34,092", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005d4" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000005cc" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 4077 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d4" } ], "repeated": 0, "id": 4078 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 4079 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 4080 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000005cc" } ], "repeated": 0, "id": 4081 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4082 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4083 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "P\\xd1\\xc9\\xe4\\xbc\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4084 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 4085 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc7c0e53f", "parentcaller": "0x7ffbc7b6faf7", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 4086 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc7b65157", "parentcaller": "0x7ffbc7b643ea", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005d8" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "CFGMGR32.dll" } ], "repeated": 0, "id": 4087 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc7b64d42", "parentcaller": "0x7ffbc7b64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005d8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc58e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0004e000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4088 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000005cc" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 4089 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc7b5fee4", "parentcaller": "0x7ffbc7b5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc592b000" }, { "name": "ModuleName", "value": "CFGMGR32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4090 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc7b5ffb5", "parentcaller": "0x7ffbc7b5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc5919000" }, { "name": "ModuleName", "value": "CFGMGR32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4091 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc7b5ffed", "parentcaller": "0x7ffbc7b5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc5919000" }, { "name": "ModuleName", "value": "CFGMGR32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4092 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc7b60068", "parentcaller": "0x7ffbc7b5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc5919000" }, { "name": "ModuleName", "value": "CFGMGR32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4093 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc7b6009c", "parentcaller": "0x7ffbc7b5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc5919000" }, { "name": "ModuleName", "value": "CFGMGR32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4094 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc7b65082", "parentcaller": "0x7ffbc7b679d2", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc5918000" }, { "name": "ModuleName", "value": "CFGMGR32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4095 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005cc" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000005d4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 4096 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 4097 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc7b97bac", "parentcaller": "0x7ffbc7b8288a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc5918000" }, { "name": "ModuleName", "value": "CFGMGR32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4098 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc7b97bac", "parentcaller": "0x7ffbc7b8288a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\CFGMGR32" }, { "name": "DllBase", "value": "0x7ffbc58e0000" } ], "repeated": 0, "id": 4099 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d4" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 4100 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d4" } ], "repeated": 0, "id": 4101 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000005b8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 4102 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005b8" }, { "name": "ValueName", "value": "DontShowSuperHidden" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DontShowSuperHidden" } ], "repeated": 0, "id": 4103 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b8" } ], "repeated": 0, "id": 4104 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 4105 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer" }, { "name": "Handle", "value": "0x000005b8" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer" } ], "repeated": 0, "id": 4106 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005b8" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x000005c8" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\" } ], "repeated": 0, "id": 4107 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "ShellState" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState" } ], "repeated": 0, "id": 4108 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "ShellState" }, { "name": "Data", "value": "$\\x00\\x00\\x004(\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState" } ], "repeated": 0, "id": 4109 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" } ], "repeated": 0, "id": 4110 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000005c8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 4111 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "NoWebView" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoWebView" } ], "repeated": 0, "id": 4112 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" } ], "repeated": 0, "id": 4113 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 4114 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000005c8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 4115 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "ClassicShell" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\ClassicShell" } ], "repeated": 0, "id": 4116 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" } ], "repeated": 0, "id": 4117 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 4118 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000005c8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 4119 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "SeparateProcess" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\SeparateProcess" } ], "repeated": 0, "id": 4120 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" } ], "repeated": 0, "id": 4121 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 4122 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000005c8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 4123 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "NoNetCrawling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoNetCrawling" } ], "repeated": 0, "id": 4124 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" } ], "repeated": 0, "id": 4125 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 4126 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005b8" }, { "name": "SubKey", "value": "Advanced" }, { "name": "Handle", "value": "0x000005c8" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" } ], "repeated": 0, "id": 4127 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "Hidden" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" } ], "repeated": 0, "id": 4128 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "ShowCompColor" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowCompColor" } ], "repeated": 0, "id": 4129 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "HideFileExt" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" } ], "repeated": 0, "id": 4130 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "DontPrettyPath" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\DontPrettyPath" } ], "repeated": 0, "id": 4131 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "ShowInfoTip" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowInfoTip" } ], "repeated": 0, "id": 4132 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "HideIcons" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideIcons" } ], "repeated": 0, "id": 4133 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "MapNetDrvBtn" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\MapNetDrvBtn" } ], "repeated": 0, "id": 4134 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "WebView" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\WebView" } ], "repeated": 0, "id": 4135 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "Filter" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Filter" } ], "repeated": 0, "id": 4136 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "ShowSuperHidden" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" } ], "repeated": 0, "id": 4137 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "SeparateProcess" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\SeparateProcess" } ], "repeated": 0, "id": 4138 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "NoNetCrawling" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\NoNetCrawling" } ], "repeated": 0, "id": 4139 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "AutoCheckSelect" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\AutoCheckSelect" } ], "repeated": 0, "id": 4140 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "IconsOnly" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\IconsOnly" } ], "repeated": 0, "id": 4141 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "ShowTypeOverlay" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowTypeOverlay" } ], "repeated": 0, "id": 4142 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "ShowStatusBar" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowStatusBar" } ], "repeated": 0, "id": 4143 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" } ], "repeated": 0, "id": 4144 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000005c8" } ], "repeated": 0, "id": 4145 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 4146 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 4147 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" } ], "repeated": 0, "id": 4148 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Directory" }, { "name": "Handle", "value": "0x000005ca" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Directory" } ], "repeated": 0, "id": 4149 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005ca" }, { "name": "SubKey", "value": "ShellEx\\IconHandler" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\ShellEx\\IconHandler" } ], "repeated": 0, "id": 4150 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Folder" }, { "name": "Handle", "value": "0x000005d6" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Folder" } ], "repeated": 0, "id": 4151 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005d6" }, { "name": "SubKey", "value": "ShellEx\\IconHandler" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\IconHandler" } ], "repeated": 0, "id": 4152 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "AllFilesystemObjects" }, { "name": "Handle", "value": "0x000005de" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\AllFilesystemObjects" } ], "repeated": 0, "id": 4153 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005de" }, { "name": "SubKey", "value": "ShellEx\\IconHandler" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\IconHandler" } ], "repeated": 0, "id": 4154 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005ca" }, { "name": "ValueName", "value": "DocObject" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\DocObject" } ], "repeated": 0, "id": 4155 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005ca" }, { "name": "SubKey", "value": "DocObject" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\DocObject" } ], "repeated": 0, "id": 4156 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005d6" }, { "name": "ValueName", "value": "DocObject" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\DocObject" } ], "repeated": 0, "id": 4157 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005d6" }, { "name": "SubKey", "value": "DocObject" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\DocObject" } ], "repeated": 0, "id": 4158 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005de" }, { "name": "ValueName", "value": "DocObject" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject" } ], "repeated": 0, "id": 4159 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005de" }, { "name": "SubKey", "value": "DocObject" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject" } ], "repeated": 0, "id": 4160 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005ca" }, { "name": "ValueName", "value": "BrowseInPlace" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\BrowseInPlace" } ], "repeated": 0, "id": 4161 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005ca" }, { "name": "SubKey", "value": "BrowseInPlace" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\BrowseInPlace" } ], "repeated": 0, "id": 4162 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005d6" }, { "name": "ValueName", "value": "BrowseInPlace" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\BrowseInPlace" } ], "repeated": 0, "id": 4163 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc58e5d32", "parentcaller": "0x7ffbc58f3fdd", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005e0" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\DeviceApi\\CMApi" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "0" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4164 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc58e5d32", "parentcaller": "0x7ffbc58f3fdd", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\cfgmgr32" }, { "name": "BaseAddress", "value": "0x7ffbc58e0000" }, { "name": "InitRoutine", "value": "0x7ffbc58f3750" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 4165 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005de" }, { "name": "SubKey", "value": "BrowseInPlace" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\BrowseInPlace" } ], "repeated": 0, "id": 4166 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc7b97881", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4167 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005ca" }, { "name": "SubKey", "value": "Clsid" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\Clsid" } ], "repeated": 0, "id": 4168 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc6495921", "parentcaller": "0x7ffbc58e1ed1", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x000005e0" }, { "name": "IoControlCode", "value": "0x00470807" }, { "name": "InBuffer", "value": "(\\x00\\x00\\x00\\x00\\x00\\x01\\x00\rc\\xf5S\\xbf\\xb6\\xd0\\x11\\x94\\xf2\\x00\\xa0\\xc9\\x1e\\xfb\\x8b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xae\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x001\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00" } ], "repeated": 0, "id": 4169 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005d6" }, { "name": "SubKey", "value": "Clsid" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\Clsid" } ], "repeated": 0, "id": 4170 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc3475ffc", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4171 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc3475ffc", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "Milliseconds", "value": "1000" } ], "repeated": 0, "id": 4172 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005de" }, { "name": "SubKey", "value": "Clsid" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\Clsid" } ], "repeated": 0, "id": 4173 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc347601a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" } ], "repeated": 0, "id": 4174 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc349286f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e8" } ], "repeated": 0, "id": 4175 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005ca" }, { "name": "ValueName", "value": "IsShortcut" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\IsShortcut" } ], "repeated": 0, "id": 4176 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005d6" }, { "name": "ValueName", "value": "IsShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\IsShortcut" } ], "repeated": 0, "id": 4177 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc348bfa7", "parentcaller": "0x7ffbc34759ad", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" } ], "repeated": 0, "id": 4178 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc5453e41", "parentcaller": "0x7ffbc54d43b9", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000005ec" }, { "name": "ValueName", "value": "Data" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Data" } ], "repeated": 0, "id": 4179 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ca" }, { "name": "ValueName", "value": "AlwaysShowExt" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\AlwaysShowExt" } ], "repeated": 0, "id": 4180 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc5453e41", "parentcaller": "0x7ffbc54d448f", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005ec" }, { "name": "ValueName", "value": "Data" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xba\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00R\\xbd\\xbb\\x88\\x1e\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x001\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Data" } ], "repeated": 0, "id": 4181 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005ca" }, { "name": "ValueName", "value": "NeverShowExt" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\NeverShowExt" } ], "repeated": 0, "id": 4182 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc348f616", "parentcaller": "0x7ffbc348bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000005ec" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 4183 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005de" }, { "name": "ValueName", "value": "NeverShowExt" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\NeverShowExt" } ], "repeated": 0, "id": 4184 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc348bf7f", "parentcaller": "0x7ffbc3475a2d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005ec" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-100000000000}\\" }, { "name": "Handle", "value": "0x000005e4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\" } ], "repeated": 0, "id": 4185 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc348bfa7", "parentcaller": "0x7ffbc3475a2d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ec" } ], "repeated": 0, "id": 4186 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005de" } ], "repeated": 0, "id": 4187 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc5c3b76b", "parentcaller": "0x7ffbc5c3b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Generation" } ], "repeated": 0, "id": 4188 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc348bfeb", "parentcaller": "0x7ffbc3475a2d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" } ], "repeated": 0, "id": 4189 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4190 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc3475fb2", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000005e4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000005ec" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 4191 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc3475ffc", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4192 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc3475ffc", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "Milliseconds", "value": "1000" } ], "repeated": 0, "id": 4193 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000005dc" } ], "repeated": 0, "id": 4194 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4195 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9872", "caller": "0x7ffbc34aa151", "parentcaller": "0x7ffbc34927a5", "category": "filesystem", "api": "GetVolumeNameForVolumeMountPointW", "status": true, "return": "0x00000001", "arguments": [ { "name": "VolumeMountPoint", "value": "\\\\?\\STORAGE#Volume#{e32a9442-5af2-11f1-ae2c-806e6f6e6963}#0000000003300000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\" }, { "name": "VolumeName", "value": "\\\\?\\Volume{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 4196 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc347601a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" } ], "repeated": 0, "id": 4197 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ec" } ], "repeated": 0, "id": 4198 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc5453a9c", "parentcaller": "0x7ffbc5453529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4199 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc5453f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005a4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4200 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000005d4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4201 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc348bf7f", "parentcaller": "0x7ffbc34759ad", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005ec" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000005e4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 4202 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d4" } ], "repeated": 0, "id": 4203 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc348bfa7", "parentcaller": "0x7ffbc34759ad", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ec" } ], "repeated": 0, "id": 4204 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc5c3b76b", "parentcaller": "0x7ffbc5c3b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "Data" }, { "name": "Data", "value": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xbaA\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00t6L\\xb3\\x1f\\x00\\x00\\x00\\x04@\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x003\\x003\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Data" } ], "repeated": 0, "id": 4205 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Category" } ], "repeated": 0, "id": 4206 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc348bfeb", "parentcaller": "0x7ffbc34759ad", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" } ], "repeated": 0, "id": 4207 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc348f616", "parentcaller": "0x7ffbc348bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000005e4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 4208 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParentFolder" } ], "repeated": 0, "id": 4209 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc348bf7f", "parentcaller": "0x7ffbc3475a2d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005e4" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000005ec" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 4210 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc348bfa7", "parentcaller": "0x7ffbc3475a2d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" } ], "repeated": 0, "id": 4211 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\Start Menu" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\RelativePath" } ], "repeated": 0, "id": 4212 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParsingName" } ], "repeated": 0, "id": 4213 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc348bfeb", "parentcaller": "0x7ffbc3475a2d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ec" } ], "repeated": 0, "id": 4214 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InfoTip" } ], "repeated": 0, "id": 4215 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc3475ffc", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4216 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc3475ffc", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ec" }, { "name": "Milliseconds", "value": "1000" } ], "repeated": 0, "id": 4217 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9872", "caller": "0x7ffbc34aa151", "parentcaller": "0x7ffbc34927a5", "category": "filesystem", "api": "GetVolumeNameForVolumeMountPointW", "status": true, "return": "0x00000001", "arguments": [ { "name": "VolumeMountPoint", "value": "\\\\?\\STORAGE#Volume#{e32a9442-5af2-11f1-ae2c-806e6f6e6963}#0000000EDDC00000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\" }, { "name": "VolumeName", "value": "\\\\?\\Volume{528c102f-0000-0000-0000-c0dd0e000000}\\" } ], "repeated": 0, "id": 4218 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc347601a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ec" } ], "repeated": 0, "id": 4219 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21786" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalizedName" } ], "repeated": 0, "id": 4220 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc349286f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" } ], "repeated": 0, "id": 4221 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 4222 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc5453f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005a4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4223 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Security" } ], "repeated": 0, "id": 4224 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResource" } ], "repeated": 0, "id": 4225 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc348bf7f", "parentcaller": "0x7ffbc34759ad", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005e4" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-c0dd0e000000}\\" }, { "name": "Handle", "value": "0x000005ec" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\" } ], "repeated": 0, "id": 4226 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc348bfa7", "parentcaller": "0x7ffbc34759ad", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" } ], "repeated": 0, "id": 4227 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4228 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Roamable" } ], "repeated": 0, "id": 4229 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc348bfeb", "parentcaller": "0x7ffbc34759ad", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ec" } ], "repeated": 0, "id": 4230 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PreCreate" } ], "repeated": 0, "id": 4231 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc348f616", "parentcaller": "0x7ffbc348bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000005ec" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 4232 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PublishExpandedPath" } ], "repeated": 0, "id": 4233 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc348bfeb", "parentcaller": "0x7ffbc3475a2d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" } ], "repeated": 0, "id": 4234 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\DefinitionFlags" } ], "repeated": 0, "id": 4235 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc546f54e", "parentcaller": "0x7ffbc347626d", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x000005e4" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x001\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4236 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc546f55e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" } ], "repeated": 0, "id": 4237 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005e4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4238 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc33b88aa", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Attributes" } ], "repeated": 0, "id": 4239 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc546f54e", "parentcaller": "0x7ffbc347620d", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005e4" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x08\\x00\\x00\\x00" } ], "repeated": 0, "id": 4240 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc546f6dd", "parentcaller": "0x7ffbc347620d", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x000005e4" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4241 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc546f55e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" } ], "repeated": 0, "id": 4242 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\FolderTypeID" } ], "repeated": 0, "id": 4243 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc546f55e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" } ], "repeated": 0, "id": 4244 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc549026b", "parentcaller": "0x7ffbc33c956d", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000005e4" } ], "repeated": 0, "id": 4245 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc54554eb", "parentcaller": "0x7ffbc33ca4ff", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "0\\xd8\\xc9\\xe4\\xbc\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4246 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc33c9591", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" } ], "repeated": 0, "id": 4247 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005e4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4248 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InitFolderHandler" } ], "repeated": 0, "id": 4249 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005e4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4250 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "10100", "caller": "0x7ffbc546f54e", "parentcaller": "0x7ffbc347626d", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x000005e4" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x00c\\x000\\x00d\\x00d\\x000\\x00e\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4251 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005c8" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PropertyBag" } ], "repeated": 0, "id": 4252 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" } ], "repeated": 0, "id": 4253 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005b8" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x000005c8" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 4254 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005c8" }, { "name": "SubKey", "value": "KnownFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders" } ], "repeated": 0, "id": 4255 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" } ], "repeated": 0, "id": 4256 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0{r]D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x80\\xc8\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4257 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005c8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 4258 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005c8" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000005d4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 4259 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" } ], "repeated": 0, "id": 4260 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d4" }, { "name": "ValueName", "value": "Start Menu" }, { "name": "Data", "value": "%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Start Menu" } ], "repeated": 0, "id": 4261 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005dc" } ], "repeated": 0, "id": 4262 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d4" } ], "repeated": 0, "id": 4263 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000005d4" } ], "repeated": 0, "id": 4264 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4265 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "p\\x7fr]D\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4266 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000005dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4267 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005dc" }, { "name": "SubKey", "value": "{A4115719-D62E-491D-AA7C-E74B8BE3B067}" }, { "name": "Handle", "value": "0x000005c8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}" } ], "repeated": 0, "id": 4268 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005dc" } ], "repeated": 0, "id": 4269 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Category" } ], "repeated": 0, "id": 4270 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Common Start Menu" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Name" } ], "repeated": 0, "id": 4271 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParentFolder" } ], "repeated": 0, "id": 4272 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Description" } ], "repeated": 0, "id": 4273 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\Start Menu" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\RelativePath" } ], "repeated": 0, "id": 4274 }, { "timestamp": "2026-05-28 23:34:34,108", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParsingName" } ], "repeated": 0, "id": 4275 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InfoTip" } ], "repeated": 0, "id": 4276 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21786" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalizedName" } ], "repeated": 0, "id": 4277 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Icon" } ], "repeated": 0, "id": 4278 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Security" } ], "repeated": 0, "id": 4279 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResource" } ], "repeated": 0, "id": 4280 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResourceType" } ], "repeated": 0, "id": 4281 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4282 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Roamable" } ], "repeated": 0, "id": 4283 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PreCreate" } ], "repeated": 0, "id": 4284 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Stream" } ], "repeated": 0, "id": 4285 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PublishExpandedPath" } ], "repeated": 0, "id": 4286 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\DefinitionFlags" } ], "repeated": 0, "id": 4287 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Attributes" } ], "repeated": 0, "id": 4288 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\FolderTypeID" } ], "repeated": 0, "id": 4289 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InitFolderHandler" } ], "repeated": 0, "id": 4290 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005c8" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PropertyBag" } ], "repeated": 0, "id": 4291 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" } ], "repeated": 0, "id": 4292 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005b8" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x000005c8" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 4293 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005c8" }, { "name": "SubKey", "value": "KnownFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders" } ], "repeated": 0, "id": 4294 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" } ], "repeated": 0, "id": 4295 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000005c8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 4296 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "Common Start Menu" }, { "name": "Data", "value": "%ProgramData%\\Microsoft\\Windows\\Start Menu" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Start Menu" } ], "repeated": 0, "id": 4297 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d4" } ], "repeated": 0, "id": 4298 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" } ], "repeated": 0, "id": 4299 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000005c8" } ], "repeated": 0, "id": 4300 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4301 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "p\\x7fr]D\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4302 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000005d4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4303 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005d4" }, { "name": "SubKey", "value": "{AE50C081-EBD2-438A-8655-8A092E34987A}" }, { "name": "Handle", "value": "0x000005dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}" } ], "repeated": 0, "id": 4304 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d4" } ], "repeated": 0, "id": 4305 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Category" } ], "repeated": 0, "id": 4306 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Recent" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Name" } ], "repeated": 0, "id": 4307 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParentFolder" } ], "repeated": 0, "id": 4308 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Description" } ], "repeated": 0, "id": 4309 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\Recent" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\RelativePath" } ], "repeated": 0, "id": 4310 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParsingName" } ], "repeated": 0, "id": 4311 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "Data", "value": "@shell32,dll,-12692" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InfoTip" } ], "repeated": 0, "id": 4312 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21797" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalizedName" } ], "repeated": 0, "id": 4313 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-117" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Icon" } ], "repeated": 0, "id": 4314 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Security" } ], "repeated": 0, "id": 4315 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResource" } ], "repeated": 0, "id": 4316 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResourceType" } ], "repeated": 0, "id": 4317 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4318 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Roamable" } ], "repeated": 0, "id": 4319 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PreCreate" } ], "repeated": 0, "id": 4320 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Stream" } ], "repeated": 0, "id": 4321 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PublishExpandedPath" } ], "repeated": 0, "id": 4322 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\DefinitionFlags" } ], "repeated": 0, "id": 4323 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Attributes" } ], "repeated": 0, "id": 4324 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\FolderTypeID" } ], "repeated": 0, "id": 4325 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InitFolderHandler" } ], "repeated": 0, "id": 4326 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005dc" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PropertyBag" } ], "repeated": 0, "id": 4327 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005dc" } ], "repeated": 0, "id": 4328 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005b8" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x000005dc" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 4329 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005dc" }, { "name": "SubKey", "value": "KnownFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders" } ], "repeated": 0, "id": 4330 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005dc" } ], "repeated": 0, "id": 4331 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0{r]D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x80\\xdc\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4332 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005dc" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 4333 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005dc" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000005d4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 4334 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005dc" } ], "repeated": 0, "id": 4335 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d4" }, { "name": "ValueName", "value": "Recent" }, { "name": "Data", "value": "%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Recent" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Recent" } ], "repeated": 0, "id": 4336 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" } ], "repeated": 0, "id": 4337 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d4" } ], "repeated": 0, "id": 4338 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000005d4" } ], "repeated": 0, "id": 4339 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4340 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "p\\x7fr]D\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4341 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000005c8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4342 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005c8" }, { "name": "SubKey", "value": "{F38BF404-1D43-42F2-9305-67DE0B28FC23}" }, { "name": "Handle", "value": "0x000005dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}" } ], "repeated": 0, "id": 4343 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" } ], "repeated": 0, "id": 4344 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Category" } ], "repeated": 0, "id": 4345 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Windows" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Name" } ], "repeated": 0, "id": 4346 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParentFolder" } ], "repeated": 0, "id": 4347 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Description" } ], "repeated": 0, "id": 4348 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\RelativePath" } ], "repeated": 0, "id": 4349 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParsingName" } ], "repeated": 0, "id": 4350 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InfoTip" } ], "repeated": 0, "id": 4351 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalizedName" } ], "repeated": 0, "id": 4352 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Icon" } ], "repeated": 0, "id": 4353 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Security" } ], "repeated": 0, "id": 4354 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResource" } ], "repeated": 0, "id": 4355 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResourceType" } ], "repeated": 0, "id": 4356 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4357 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Roamable" } ], "repeated": 0, "id": 4358 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PreCreate" } ], "repeated": 0, "id": 4359 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Stream" } ], "repeated": 0, "id": 4360 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PublishExpandedPath" } ], "repeated": 0, "id": 4361 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\DefinitionFlags" } ], "repeated": 0, "id": 4362 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Attributes" } ], "repeated": 0, "id": 4363 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\FolderTypeID" } ], "repeated": 0, "id": 4364 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005dc" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InitFolderHandler" } ], "repeated": 0, "id": 4365 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005dc" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x000005e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PropertyBag" } ], "repeated": 0, "id": 4366 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005dc" } ], "repeated": 0, "id": 4367 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d4" } ], "repeated": 0, "id": 4368 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000005d4" } ], "repeated": 0, "id": 4369 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4370 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "p\\x7fr]D\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4371 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000005dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4372 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005dc" }, { "name": "SubKey", "value": "{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}" }, { "name": "Handle", "value": "0x000005f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}" } ], "repeated": 0, "id": 4373 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005dc" } ], "repeated": 0, "id": 4374 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Category" } ], "repeated": 0, "id": 4375 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "System" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Name" } ], "repeated": 0, "id": 4376 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParentFolder" } ], "repeated": 0, "id": 4377 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Description" } ], "repeated": 0, "id": 4378 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\RelativePath" } ], "repeated": 0, "id": 4379 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParsingName" } ], "repeated": 0, "id": 4380 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InfoTip" } ], "repeated": 0, "id": 4381 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalizedName" } ], "repeated": 0, "id": 4382 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Icon" } ], "repeated": 0, "id": 4383 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Security" } ], "repeated": 0, "id": 4384 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResource" } ], "repeated": 0, "id": 4385 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResourceType" } ], "repeated": 0, "id": 4386 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4387 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Roamable" } ], "repeated": 0, "id": 4388 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PreCreate" } ], "repeated": 0, "id": 4389 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Stream" } ], "repeated": 0, "id": 4390 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PublishExpandedPath" } ], "repeated": 0, "id": 4391 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\DefinitionFlags" } ], "repeated": 0, "id": 4392 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Attributes" } ], "repeated": 0, "id": 4393 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\FolderTypeID" } ], "repeated": 0, "id": 4394 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InitFolderHandler" } ], "repeated": 0, "id": 4395 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005f0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x000005dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PropertyBag" } ], "repeated": 0, "id": 4396 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" } ], "repeated": 0, "id": 4397 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d4" } ], "repeated": 0, "id": 4398 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000005d4" } ], "repeated": 0, "id": 4399 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4400 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "p\\x7fr]D\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4401 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000005f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4402 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005f0" }, { "name": "SubKey", "value": "{FDD39AD0-238F-46AF-ADB4-6C85480369C7}" }, { "name": "Handle", "value": "0x000005e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}" } ], "repeated": 0, "id": 4403 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" } ], "repeated": 0, "id": 4404 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Category" } ], "repeated": 0, "id": 4405 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Personal" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Name" } ], "repeated": 0, "id": 4406 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParentFolder" } ], "repeated": 0, "id": 4407 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Description" } ], "repeated": 0, "id": 4408 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Documents" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\RelativePath" } ], "repeated": 0, "id": 4409 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "shell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\::{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParsingName" } ], "repeated": 0, "id": 4410 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InfoTip" } ], "repeated": 0, "id": 4411 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\windows.storage.dll,-21770" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalizedName" } ], "repeated": 0, "id": 4412 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-112" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Icon" } ], "repeated": 0, "id": 4413 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Security" } ], "repeated": 0, "id": 4414 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResource" } ], "repeated": 0, "id": 4415 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResourceType" } ], "repeated": 0, "id": 4416 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4417 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "Roamable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Roamable" } ], "repeated": 0, "id": 4418 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PreCreate" } ], "repeated": 0, "id": 4419 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Stream" } ], "repeated": 0, "id": 4420 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PublishExpandedPath" } ], "repeated": 0, "id": 4421 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\DefinitionFlags" } ], "repeated": 0, "id": 4422 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Attributes" } ], "repeated": 0, "id": 4423 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\FolderTypeID" } ], "repeated": 0, "id": 4424 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InitFolderHandler" } ], "repeated": 0, "id": 4425 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005e4" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x000005f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PropertyBag" } ], "repeated": 0, "id": 4426 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" } ], "repeated": 0, "id": 4427 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005b8" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x000005e4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 4428 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005e4" }, { "name": "SubKey", "value": "KnownFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders" } ], "repeated": 0, "id": 4429 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" } ], "repeated": 0, "id": 4430 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0{r]D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x80\\xe4\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4431 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005e4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 4432 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005e4" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000005ec" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 4433 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" } ], "repeated": 0, "id": 4434 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ec" }, { "name": "ValueName", "value": "Personal" }, { "name": "Data", "value": "%USERPROFILE%\\Documents" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Personal" } ], "repeated": 0, "id": 4435 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4ce4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4436 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d4" } ], "repeated": 0, "id": 4437 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ec" } ], "repeated": 0, "id": 4438 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000005ec" } ], "repeated": 0, "id": 4439 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4440 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "p\\x7fr]D\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4441 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000005d4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4442 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005d4" }, { "name": "SubKey", "value": "{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}" }, { "name": "Handle", "value": "0x000005e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}" } ], "repeated": 0, "id": 4443 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d4" } ], "repeated": 0, "id": 4444 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Category" } ], "repeated": 0, "id": 4445 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Fonts" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Name" } ], "repeated": 0, "id": 4446 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{F38BF404-1D43-42F2-9305-67DE0B28FC23}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParentFolder" } ], "repeated": 0, "id": 4447 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Description" } ], "repeated": 0, "id": 4448 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\RelativePath" } ], "repeated": 0, "id": 4449 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParsingName" } ], "repeated": 0, "id": 4450 }, { "timestamp": "2026-05-28 23:34:34,124", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InfoTip" } ], "repeated": 0, "id": 4451 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalizedName" } ], "repeated": 0, "id": 4452 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Icon" } ], "repeated": 0, "id": 4453 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Security" } ], "repeated": 0, "id": 4454 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResource" } ], "repeated": 0, "id": 4455 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResourceType" } ], "repeated": 0, "id": 4456 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4457 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Roamable" } ], "repeated": 0, "id": 4458 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PreCreate" } ], "repeated": 0, "id": 4459 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Stream" } ], "repeated": 0, "id": 4460 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PublishExpandedPath" } ], "repeated": 0, "id": 4461 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\DefinitionFlags" } ], "repeated": 0, "id": 4462 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Attributes" } ], "repeated": 0, "id": 4463 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\FolderTypeID" } ], "repeated": 0, "id": 4464 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InitFolderHandler" } ], "repeated": 0, "id": 4465 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005e4" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x000005d4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PropertyBag" } ], "repeated": 0, "id": 4466 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" } ], "repeated": 0, "id": 4467 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ec" } ], "repeated": 0, "id": 4468 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4469 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4470 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3a85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4471 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "MutexName", "value": "Local\\SM0:9452:120:WilError_03" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 4472 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4473 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4474 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ec" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4475 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4476 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4477 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" } ], "repeated": 0, "id": 4478 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ec" } ], "repeated": 0, "id": 4479 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" } ], "repeated": 0, "id": 4480 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" } ], "repeated": 0, "id": 4481 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000005c8" } ], "repeated": 0, "id": 4482 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 4483 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 4484 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" } ], "repeated": 0, "id": 4485 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Directory" }, { "name": "Handle", "value": "0x000005ca" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Directory" } ], "repeated": 0, "id": 4486 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005ca" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Directory" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4487 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005ca" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 4488 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000005ca" }, { "name": "ObjectAttributesName", "value": "ShellEx\\PropertyHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\ShellEx\\PropertyHandler" } ], "repeated": 0, "id": 4489 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\Directory\\ShellEx\\PropertyHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Directory\\ShellEx\\PropertyHandler" } ], "repeated": 0, "id": 4490 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Folder" }, { "name": "Handle", "value": "0x000005ee" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Folder" } ], "repeated": 0, "id": 4491 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005ee" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\Folder" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4492 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005ee" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4493 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xafr]D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00\\xee\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00`\\xb0r]D\\x00\\x00\\x00" } ], "repeated": 0, "id": 4494 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Folder\\ShellEx\\PropertyHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Folder\\ShellEx\\PropertyHandler" } ], "repeated": 0, "id": 4495 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005ee" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4496 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000005ee" }, { "name": "ObjectAttributesName", "value": "ShellEx\\PropertyHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\PropertyHandler" } ], "repeated": 0, "id": 4497 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "AllFilesystemObjects" }, { "name": "Handle", "value": "0x000005e6" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\AllFilesystemObjects" } ], "repeated": 0, "id": 4498 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005e6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4499 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4500 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xafr]D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00\\xe6\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00D\\x00\\x00\\x00`\\xb0r]D\\x00\\x00\\x00" } ], "repeated": 0, "id": 4501 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\AllFilesystemObjects\\ShellEx\\PropertyHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AllFilesystemObjects\\ShellEx\\PropertyHandler" } ], "repeated": 0, "id": 4502 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4503 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000005e6" }, { "name": "ObjectAttributesName", "value": "ShellEx\\PropertyHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\PropertyHandler" } ], "repeated": 0, "id": 4504 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ca" } ], "repeated": 0, "id": 4505 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ee" } ], "repeated": 0, "id": 4506 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e6" } ], "repeated": 0, "id": 4507 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x000005e4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 4508 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005e4" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4509 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e4" } ], "repeated": 0, "id": 4510 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Drive\\shellex\\FolderExtensions" }, { "name": "Handle", "value": "0x000005e6" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions" } ], "repeated": 0, "id": 4511 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e6" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{fbeb8a05-beee-4442-804e-409d6c4515e9}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}" } ], "repeated": 0, "id": 4512 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}" }, { "name": "Handle", "value": "0x000005f6" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}" } ], "repeated": 0, "id": 4513 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f6" }, { "name": "ValueName", "value": "DriveMask" }, { "name": "Data", "value": "32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}\\DriveMask" } ], "repeated": 0, "id": 4514 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f6" } ], "repeated": 0, "id": 4515 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegEnumKeyExW", "status": false, "return": "0x00000103", "pretty_return": "NO_MORE_ITEMS", "arguments": [ { "name": "Handle", "value": "0x000005e6" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\" } ], "repeated": 0, "id": 4516 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e6" } ], "repeated": 0, "id": 4517 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce9706000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4518 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000005f4" } ], "repeated": 0, "id": 4519 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4520 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 4521 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9CFC2DF3-6BA3-46EF-A836-E519E81F0EC4" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4522 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4523 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x000005f4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 4524 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005f4" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4525 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 4526 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\windows.storage.dll" }, { "name": "BaseAddress", "value": "0x7ffbc3310000" } ], "repeated": 0, "id": 4527 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 4528 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "FindFirstFileExW", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\LocalState\\ToastCollectionIcons\\*" } ], "repeated": 0, "id": 4529 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c0010b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4530 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "10132", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7272ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000594" } ], "repeated": 1, "id": 4531 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00056000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4532 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\x9b>h\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 4533 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4534 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "Milliseconds", "value": "4500" } ], "repeated": 0, "id": 4535 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9812", "caller": "0x7ffbc5455810", "parentcaller": "0x1bcec0cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000103", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00l?h\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00#\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 4536 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xc3?h\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00#\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00}\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 4537 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "10132", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7272ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000594" } ], "repeated": 7, "id": 4538 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "10132", "caller": "0x7ffbc54508ee", "parentcaller": "0x7ffbc7298bd7", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000594" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "9452" } ], "repeated": 0, "id": 4539 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "10132", "caller": "0x7ffbc549026b", "parentcaller": "0x7ffbc545cbb0", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000594" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000005fc" } ], "repeated": 0, "id": 4540 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "10132", "caller": "0x7ffbc545aa1f", "parentcaller": "0x7ffbc545cb7c", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 4541 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "10132", "caller": "0x7ffbc545aaa8", "parentcaller": "0x7ffbc545cb7c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00P\\xbe\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\xf0\\xbe\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xbf\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00$\\xc0\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\xc0\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00@\\xc0\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xc0\\xc9\\xe4\\xbc\\x01\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00h\\xc0\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\xc0\\xc9\\xe4\\xbc\\x01\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00@\\xbf\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\xc6\\xbf\\xc9\\xe4\\xbc\\x01\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\xcc\\xbf\\xc9\\xe4\\xbc\\x01\\x00\\x00" } ], "repeated": 0, "id": 4542 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "10132", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc545cbbe", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005fc" } ], "repeated": 0, "id": 4543 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "10132", "caller": "0x7ffbc549026b", "parentcaller": "0x7ffbc545cbb0", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000594" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000005fc" } ], "repeated": 0, "id": 4544 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "10132", "caller": "0x7ffbc545aa1f", "parentcaller": "0x7ffbc545cb7c", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 4545 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "10132", "caller": "0x7ffbc545aaa8", "parentcaller": "0x7ffbc545cb7c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00P\\xbe\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\xf0\\xbe\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xbf\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00$\\xc0\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\xc0\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00@\\xc0\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xc0\\xc9\\xe4\\xbc\\x01\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00h\\xc0\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\xc0\\xc9\\xe4\\xbc\\x01\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00@\\xbf\\xc9\\xe4\\xbc\\x01\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\xc6\\xbf\\xc9\\xe4\\xbc\\x01\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\xcc\\xbf\\xc9\\xe4\\xbc\\x01\\x00\\x00" } ], "repeated": 0, "id": 4546 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "10132", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc545cbbe", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005fc" } ], "repeated": 0, "id": 4547 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "10132", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbb0929183", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000594" } ], "repeated": 0, "id": 4548 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "10132", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4549 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "10132", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4550 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "10132", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4551 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "10132", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4552 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "10132", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc71f6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000594" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 4553 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "10132", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc728224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4554 }, { "timestamp": "2026-05-28 23:34:34,139", "thread_id": "10132", "caller": "0x7ffbc7051630", "parentcaller": "0x7ffbc70512cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4555 }, { "timestamp": "2026-05-28 23:34:34,155", "thread_id": "10132", "caller": "0x7ffbc7017042", "parentcaller": "0x7ffbc7016fa4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c4" } ], "repeated": 1, "id": 4556 }, { "timestamp": "2026-05-28 23:34:34,155", "thread_id": "10132", "caller": "0x7ffbc548ebae", "parentcaller": "0x7ffbc5c35b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x8f]D\\x00\\x00\\x00\\xec$\\x00\\x00\\x00\\x00\\x00\\x00\\x94'\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "10132" } ], "repeated": 0, "id": 4557 }, { "timestamp": "2026-05-28 23:34:34,155", "thread_id": "9840", "caller": "0x7ffbc548ebae", "parentcaller": "0x7ffbc5c684de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x8f]D\\x00\\x00\\x00\\xec$\\x00\\x00\\x00\\x00\\x00\\x00p&\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9840" } ], "repeated": 0, "id": 4558 }, { "timestamp": "2026-05-28 23:34:34,155", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4559 }, { "timestamp": "2026-05-28 23:34:34,155", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "Milliseconds", "value": "4495" } ], "repeated": 0, "id": 4560 }, { "timestamp": "2026-05-28 23:34:34,155", "thread_id": "9840", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4561 }, { "timestamp": "2026-05-28 23:34:34,155", "thread_id": "9840", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4562 }, { "timestamp": "2026-05-28 23:34:34,155", "thread_id": "9840", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4563 }, { "timestamp": "2026-05-28 23:34:34,155", "thread_id": "9840", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4564 }, { "timestamp": "2026-05-28 23:34:34,155", "thread_id": "9840", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc728224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4565 }, { "timestamp": "2026-05-28 23:34:34,155", "thread_id": "9840", "caller": "0x7ffbc7051630", "parentcaller": "0x7ffbc70512cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4566 }, { "timestamp": "2026-05-28 23:34:34,155", "thread_id": "9840", "caller": "0x7ffbc548ebae", "parentcaller": "0x7ffbc5c3712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x8f]D\\x00\\x00\\x00\\xec$\\x00\\x00\\x00\\x00\\x00\\x00p&\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9840" } ], "repeated": 0, "id": 4567 }, { "timestamp": "2026-05-28 23:34:34,155", "thread_id": "10132", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7272ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c4" } ], "repeated": 1, "id": 4568 }, { "timestamp": "2026-05-28 23:34:34,155", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00Chh\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 4569 }, { "timestamp": "2026-05-28 23:34:34,155", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4570 }, { "timestamp": "2026-05-28 23:34:34,155", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "Milliseconds", "value": "4489" } ], "repeated": 0, "id": 4571 }, { "timestamp": "2026-05-28 23:34:34,295", "thread_id": "9592", "caller": "0x7ffbc7b70880", "parentcaller": "0x7ffbc7b73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce4ccd000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4572 }, { "timestamp": "2026-05-28 23:34:38,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00144000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4573 }, { "timestamp": "2026-05-28 23:34:38,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00148000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4574 }, { "timestamp": "2026-05-28 23:34:38,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c0012c000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4575 }, { "timestamp": "2026-05-28 23:34:38,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x438c00148000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4576 }, { "timestamp": "2026-05-28 23:34:38,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4577 }, { "timestamp": "2026-05-28 23:34:38,655", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "Milliseconds", "value": "340" } ], "repeated": 0, "id": 4578 }, { "timestamp": "2026-05-28 23:34:38,999", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x004S\\xb2\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00%\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00/\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 4579 }, { "timestamp": "2026-05-28 23:34:38,999", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4580 }, { "timestamp": "2026-05-28 23:34:38,999", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "Milliseconds", "value": "155" } ], "repeated": 0, "id": 4581 }, { "timestamp": "2026-05-28 23:34:38,999", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4582 }, { "timestamp": "2026-05-28 23:34:38,999", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "Milliseconds", "value": "155" } ], "repeated": 0, "id": 4583 }, { "timestamp": "2026-05-28 23:34:38,999", "thread_id": "9812", "caller": "0x7ffbc5455810", "parentcaller": "0x1bcec0cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000103", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\x9cU\\xb2\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00/\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "64" } ], "repeated": 0, "id": 4584 }, { "timestamp": "2026-05-28 23:34:39,155", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\r\\xb5\\xb4\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00&\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 4585 }, { "timestamp": "2026-05-28 23:34:39,155", "thread_id": "9456", "caller": "0x7ffbc54430ce", "parentcaller": "0x1bcec20ee58", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4586 }, { "timestamp": "2026-05-28 23:34:39,155", "thread_id": "9456", "caller": "0x7ffbc54430ce", "parentcaller": "0x1bcec20ee58", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "Milliseconds", "value": "15498" } ], "repeated": 0, "id": 4587 }, { "timestamp": "2026-05-28 23:34:39,155", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4588 }, { "timestamp": "2026-05-28 23:34:39,155", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 4589 }, { "timestamp": "2026-05-28 23:34:39,155", "thread_id": "9812", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000103", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00o\\xb7\\xb4\\x03\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00%\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "64" } ], "repeated": 0, "id": 4590 }, { "timestamp": "2026-05-28 23:34:40,639", "thread_id": "9796", "caller": "0x7ffbc54430ce", "parentcaller": "0x1bcec20ee58", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4591 }, { "timestamp": "2026-05-28 23:34:40,639", "thread_id": "9796", "caller": "0x7ffbc54430ce", "parentcaller": "0x1bcec20ee58", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" }, { "name": "Milliseconds", "value": "10000" } ], "repeated": 0, "id": 4592 }, { "timestamp": "2026-05-28 23:34:44,170", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x0009\\x01\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 4593 }, { "timestamp": "2026-05-28 23:34:44,170", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4594 }, { "timestamp": "2026-05-28 23:34:44,170", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "Milliseconds", "value": "10483" } ], "repeated": 0, "id": 4595 }, { "timestamp": "2026-05-28 23:34:44,170", "thread_id": "9812", "caller": "0x7ffbc5455810", "parentcaller": "0x1bcec0cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000103", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\xcc;\\x01\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00&\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "64" } ], "repeated": 0, "id": 4596 }, { "timestamp": "2026-05-28 23:34:44,170", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc0e9f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4597 }, { "timestamp": "2026-05-28 23:34:44,170", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc6e60000" } ], "repeated": 0, "id": 4598 }, { "timestamp": "2026-05-28 23:34:44,170", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4599 }, { "timestamp": "2026-05-28 23:34:44,170", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" }, { "name": "Milliseconds", "value": "10480" } ], "repeated": 0, "id": 4600 }, { "timestamp": "2026-05-28 23:34:44,170", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce9530000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 4601 }, { "timestamp": "2026-05-28 23:34:44,170", "thread_id": "9812", "caller": "0x7ffbc54553aa", "parentcaller": "0x1bcebca0093", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\xd7N\\x01\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00*\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "64" } ], "repeated": 0, "id": 4602 }, { "timestamp": "2026-05-28 23:34:44,170", "thread_id": "9812", "caller": "0x7ffbc54553aa", "parentcaller": "0x1bcec0cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\xf1Q\\x01\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00)\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "64" } ], "repeated": 0, "id": 4603 }, { "timestamp": "2026-05-28 23:34:44,170", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016e4" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\x18S\\x01\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00*\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "64" } ], "repeated": 0, "id": 4604 }, { "timestamp": "2026-05-28 23:34:44,170", "thread_id": "9456", "caller": "0x7ff64b574c88", "parentcaller": "0x7ff64b55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" } ], "repeated": 0, "id": 4605 }, { "timestamp": "2026-05-28 23:34:44,170", "thread_id": "9456", "caller": "0x7ff64b574c88", "parentcaller": "0x7ff64b55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" } ], "repeated": 0, "id": 4606 }, { "timestamp": "2026-05-28 23:34:44,170", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000328" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x8e]D\\x00\\x00\\x00\\xec$\\x00\\x00\\x00\\x00\\x00\\x00T&\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9812" } ], "repeated": 0, "id": 4607 }, { "timestamp": "2026-05-28 23:34:44,170", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4608 }, { "timestamp": "2026-05-28 23:34:44,170", "thread_id": "9812", "caller": "0x7ff64b574c88", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 4609 }, { "timestamp": "2026-05-28 23:34:44,170", "thread_id": "9812", "caller": "0x7ffbc548ebae", "parentcaller": "0x1bcec2c9d18", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x8e]D\\x00\\x00\\x00\\xec$\\x00\\x00\\x00\\x00\\x00\\x00T&\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9812" } ], "repeated": 0, "id": 4610 }, { "timestamp": "2026-05-28 23:34:44,170", "thread_id": "9812", "caller": "0x7ff64b574c88", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000033c" } ], "repeated": 0, "id": 4611 }, { "timestamp": "2026-05-28 23:34:44,170", "thread_id": "9812", "caller": "0x7ffbc7ba467e", "parentcaller": "0x7ffbc649734d", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9812" } ], "repeated": 0, "id": 4612 }, { "timestamp": "2026-05-28 23:34:44,170", "thread_id": "9812", "caller": "0x7ffbc7ba469e", "parentcaller": "0x7ffbc649734d", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 4613 }, { "timestamp": "2026-05-28 23:34:44,170", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 4614 }, { "timestamp": "2026-05-28 23:34:44,170", "thread_id": "9456", "caller": "0x7ff64b574c88", "parentcaller": "0x7ff64b55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f0" } ], "repeated": 0, "id": 4615 }, { "timestamp": "2026-05-28 23:34:44,170", "thread_id": "9456", "caller": "0x7ff64b574c88", "parentcaller": "0x7ff64b55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" } ], "repeated": 0, "id": 4616 }, { "timestamp": "2026-05-28 23:34:44,170", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x000002f8" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x8e]D\\x00\\x00\\x00\\xec$\\x00\\x00\\x00\\x00\\x00\\x00H&\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9800" } ], "repeated": 0, "id": 4617 }, { "timestamp": "2026-05-28 23:34:44,170", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4618 }, { "timestamp": "2026-05-28 23:34:44,170", "thread_id": "9800", "caller": "0x7ff64b574c88", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000030c" } ], "repeated": 0, "id": 4619 }, { "timestamp": "2026-05-28 23:34:44,170", "thread_id": "9800", "caller": "0x7ffbc548ebae", "parentcaller": "0x1bcec2c9d18", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x8e]D\\x00\\x00\\x00\\xec$\\x00\\x00\\x00\\x00\\x00\\x00H&\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9800" } ], "repeated": 0, "id": 4620 }, { "timestamp": "2026-05-28 23:34:44,170", "thread_id": "9800", "caller": "0x7ff64b574c88", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000308" } ], "repeated": 0, "id": 4621 }, { "timestamp": "2026-05-28 23:34:44,170", "thread_id": "9800", "caller": "0x7ffbc7ba467e", "parentcaller": "0x7ffbc649734d", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9800" } ], "repeated": 0, "id": 4622 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9800", "caller": "0x7ffbc7ba469e", "parentcaller": "0x7ffbc649734d", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 4623 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 4624 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4625 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4626 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9456", "caller": "0x7ff64b574c88", "parentcaller": "0x7ff64b55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 4627 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9456", "caller": "0x7ff64b574c88", "parentcaller": "0x7ff64b55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 4628 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce9b30000" }, { "name": "RegionSize", "value": "0x000d6000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 4629 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9456", "caller": "0x7ff64b574c88", "parentcaller": "0x7ff64b55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 4630 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9456", "caller": "0x7ff64b574c88", "parentcaller": "0x7ff64b55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 4631 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bc80000000" }, { "name": "RegionSize", "value": "0x021d5000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 4632 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9456", "caller": "0x7ff64b574c88", "parentcaller": "0x7ff64b55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 4633 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9456", "caller": "0x7ff64b574c88", "parentcaller": "0x7ff64b55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 4634 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce9940000" }, { "name": "RegionSize", "value": "0x001e6000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 4635 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9456", "caller": "0x7ff64b574c88", "parentcaller": "0x7ff64b55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a0" } ], "repeated": 0, "id": 4636 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9456", "caller": "0x7ff64b574c88", "parentcaller": "0x7ff64b55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000029c" } ], "repeated": 0, "id": 4637 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1bce9800000" }, { "name": "RegionSize", "value": "0x0013b000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 4638 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9456", "caller": "0x7ff64b574c88", "parentcaller": "0x7ff64b55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000298" } ], "repeated": 0, "id": 4639 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9456", "caller": "0x7ff64b574c88", "parentcaller": "0x7ff64b55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" } ], "repeated": 0, "id": 4640 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc65a0000" }, { "name": "FunctionName", "value": "UnregisterTraceGuids" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7ba0340" } ], "repeated": 0, "id": 4641 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 4642 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000258" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x8e]D\\x00\\x00\\x00\\xec$\\x00\\x00\\x00\\x00\\x00\\x008&\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9784" } ], "repeated": 0, "id": 4643 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000258" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4644 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9784", "caller": "0x7ff64b574c88", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000270" } ], "repeated": 0, "id": 4645 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9784", "caller": "0x7ffbc548ebae", "parentcaller": "0x1bcec2c9d18", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x8e]D\\x00\\x00\\x00\\xec$\\x00\\x00\\x00\\x00\\x00\\x008&\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9784" } ], "repeated": 0, "id": 4646 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9784", "caller": "0x7ff64b574c88", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000026c" } ], "repeated": 0, "id": 4647 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9784", "caller": "0x7ffbc7ba467e", "parentcaller": "0x7ffbc649734d", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9784" } ], "repeated": 0, "id": 4648 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9784", "caller": "0x7ffbc7ba469e", "parentcaller": "0x7ffbc649734d", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 4649 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9456", "caller": "0x7ff64b55b649", "parentcaller": "0x7ff64b614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000258" } ], "repeated": 0, "id": 4650 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9456", "caller": "0x7ff64b574c88", "parentcaller": "0x7ff64b55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 4651 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9456", "caller": "0x7ff64b574c88", "parentcaller": "0x7ff64b55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 4652 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9456", "caller": "0x7ff64b574c88", "parentcaller": "0x7ff64b55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 4653 }, { "timestamp": "2026-05-28 23:34:44,186", "thread_id": "9456", "caller": "0x7ff64b55b65c", "parentcaller": "0x7ff64b614f22", "category": "process", "api": "NtTerminateProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "ExitCode", "value": "0x00000000" } ], "repeated": 0, "id": 4654 } ], "threads": [ "9456", "9624", "9628", "9616", "9620", "9776", "9784", "9792", "9796", "9800", "9804", "9808", "9812", "9840", "9868", "9872", "9876", "9880", "9592", "10100", "10132" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5816,i,7984218614831481947,5522388298470254199,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5860 /prefetch:8", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff64b540000", "MainExeSize": "0x0028c000", "Bitness": "64-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } }, { "process_id": 844, "process_name": "svchost.exe", "parent_id": 632, "module_path": "C:\\Windows\\System32\\svchost.exe", "first_seen": "2026-05-28 23:34:31,217", "calls": [ { "timestamp": "2026-05-28 23:34:40,780", "thread_id": "1144", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001564" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 0 }, { "timestamp": "2026-05-28 23:34:44,139", "thread_id": "420", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc703ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001568" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-05-28 23:34:50,780", "thread_id": "1108", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001584" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-05-28 23:34:58,420", "thread_id": "1108", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc544e6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7ffbc4230000" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-05-28 23:34:58,780", "thread_id": "1108", "caller": "0x7ffbc31422bd", "parentcaller": "0x7ffbc304ce49", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001588" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000014d4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 4 }, { "timestamp": "2026-05-28 23:34:58,780", "thread_id": "1108", "caller": "0x7ffbc31422bd", "parentcaller": "0x7ffbc304ce49", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001588" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000008fc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-05-28 23:34:58,780", "thread_id": "1108", "caller": "0x7ffbc3047024", "parentcaller": "0x7ffbc3047125", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000008fc" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001564" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 6 }, { "timestamp": "2026-05-28 23:34:58,780", "thread_id": "1144", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc31d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000004c0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000d3c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 7 }, { "timestamp": "2026-05-28 23:34:58,780", "thread_id": "1144", "caller": "0x7ffbc547c5f2", "parentcaller": "0x7ffbc54789f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000159c" }, { "name": "ThreadHandle", "value": "0x00001598" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\SystemApps\\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\\CHXSmartScreen.exe" }, { "name": "CommandLine", "value": "\"C:\\Windows\\SystemApps\\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\\CHXSmartScreen.exe\" -ServerName:App.AppXk7vvv12h4qrkhkbvf6j86ja45mzj5km9.mca" }, { "name": "DllPath", "value": "C:\\Windows\\SystemApps\\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy;" }, { "name": "ProcessId", "value": "140716013523252" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-05-28 23:34:58,795", "thread_id": "1144", "caller": "0x7ffbc54789f3", "parentcaller": "0x7ffbc649de30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\SystemApps\\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\\CHXSmartScreen.exe" }, { "name": "CommandLine", "value": "\"C:\\Windows\\SystemApps\\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\\CHXSmartScreen.exe\" -ServerName:App.AppXk7vvv12h4qrkhkbvf6j86ja45mzj5km9.mca" }, { "name": "CreationFlags", "value": "0x00080414", "pretty_value": "CREATE_SUSPENDED|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "4404" }, { "name": "ThreadId", "value": "4268" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x0000159c" }, { "name": "ThreadHandle", "value": "0x00001598" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-05-28 23:34:58,811", "thread_id": "1144", "caller": "0x7ffbc31f3391", "parentcaller": "0x7ffbc31b1704", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00001598" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "4268" }, { "name": "ProcessId", "value": "4404" } ], "repeated": 0, "id": 10 }, { "timestamp": "2026-05-28 23:34:58,811", "thread_id": "1000", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc71f6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001388" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-05-28 23:34:59,405", "thread_id": "1088", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006a8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-05-28 23:34:59,405", "thread_id": "1088", "caller": "0x7ffbc5433d8e", "parentcaller": "0x7ffbc5433354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000350" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-05-28 23:34:59,405", "thread_id": "1088", "caller": "0x7ffbc5433395", "parentcaller": "0x7ffbc5433f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-05-28 23:34:59,405", "thread_id": "1088", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x1b4a62d0000" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-18.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-05-28 23:34:59,405", "thread_id": "4372", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015d4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-05-28 23:34:59,405", "thread_id": "4372", "caller": "0x7ffbc5433d8e", "parentcaller": "0x7ffbc5433354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015dc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-05-28 23:34:59,405", "thread_id": "4372", "caller": "0x7ffbc5433395", "parentcaller": "0x7ffbc5433f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-05-28 23:34:59,405", "thread_id": "4372", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006e8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-05-28 23:34:59,405", "thread_id": "4372", "caller": "0x7ffbc5433d8e", "parentcaller": "0x7ffbc5433354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015dc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-05-28 23:34:59,405", "thread_id": "4372", "caller": "0x7ffbc5433395", "parentcaller": "0x7ffbc5433f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-05-28 23:34:59,405", "thread_id": "4372", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006e8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-05-28 23:34:59,405", "thread_id": "4372", "caller": "0x7ffbc5433d8e", "parentcaller": "0x7ffbc5433354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015dc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-05-28 23:34:59,405", "thread_id": "4372", "caller": "0x7ffbc5433395", "parentcaller": "0x7ffbc5433f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-05-28 23:34:59,405", "thread_id": "4372", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015dc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 25 }, { "timestamp": "2026-05-28 23:34:59,405", "thread_id": "4372", "caller": "0x7ffbc5433d8e", "parentcaller": "0x7ffbc5433354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000006e8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-05-28 23:34:59,405", "thread_id": "4372", "caller": "0x7ffbc5433395", "parentcaller": "0x7ffbc5433f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-05-28 23:34:59,405", "thread_id": "4372", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000014bc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-05-28 23:34:59,405", "thread_id": "4372", "caller": "0x7ffbc5433d8e", "parentcaller": "0x7ffbc5433354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000d3c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-05-28 23:34:59,405", "thread_id": "4372", "caller": "0x7ffbc5433395", "parentcaller": "0x7ffbc5433f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-05-28 23:34:59,405", "thread_id": "4372", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d3c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-05-28 23:34:59,405", "thread_id": "4372", "caller": "0x7ffbc5433d8e", "parentcaller": "0x7ffbc5433354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000014bc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-05-28 23:34:59,405", "thread_id": "4372", "caller": "0x7ffbc5433395", "parentcaller": "0x7ffbc5433f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-05-28 23:34:59,420", "thread_id": "4372", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000350" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-05-28 23:34:59,420", "thread_id": "4372", "caller": "0x7ffbc5433d8e", "parentcaller": "0x7ffbc5433354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000014d4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-05-28 23:34:59,420", "thread_id": "4372", "caller": "0x7ffbc5433395", "parentcaller": "0x7ffbc5433f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-05-28 23:34:59,420", "thread_id": "4372", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015a0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-05-28 23:34:59,420", "thread_id": "4372", "caller": "0x7ffbc5433d8e", "parentcaller": "0x7ffbc5433354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000001e4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-05-28 23:34:59,420", "thread_id": "4372", "caller": "0x7ffbc5433395", "parentcaller": "0x7ffbc5433f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-05-28 23:34:59,420", "thread_id": "4372", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000001e4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-05-28 23:34:59,420", "thread_id": "4372", "caller": "0x7ffbc5433d8e", "parentcaller": "0x7ffbc5433354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015a0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-05-28 23:34:59,420", "thread_id": "4372", "caller": "0x7ffbc5433395", "parentcaller": "0x7ffbc5433f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-05-28 23:34:59,420", "thread_id": "4372", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015a0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-05-28 23:34:59,420", "thread_id": "4372", "caller": "0x7ffbc5433d8e", "parentcaller": "0x7ffbc5433354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000001e4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-05-28 23:34:59,420", "thread_id": "4372", "caller": "0x7ffbc5433395", "parentcaller": "0x7ffbc5433f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-05-28 23:34:59,420", "thread_id": "4372", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000001e4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-05-28 23:34:59,420", "thread_id": "4372", "caller": "0x7ffbc5433d8e", "parentcaller": "0x7ffbc5433354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015a0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-05-28 23:34:59,420", "thread_id": "4372", "caller": "0x7ffbc5433395", "parentcaller": "0x7ffbc5433f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-05-28 23:34:59,420", "thread_id": "4372", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015a0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-05-28 23:34:59,420", "thread_id": "4372", "caller": "0x7ffbc5433d8e", "parentcaller": "0x7ffbc5433354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000001e4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-05-28 23:34:59,420", "thread_id": "4372", "caller": "0x7ffbc5433395", "parentcaller": "0x7ffbc5433f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-05-28 23:34:59,420", "thread_id": "4372", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000001e4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-05-28 23:34:59,420", "thread_id": "4372", "caller": "0x7ffbc5433d8e", "parentcaller": "0x7ffbc5433354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015a0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-05-28 23:34:59,420", "thread_id": "4372", "caller": "0x7ffbc5433395", "parentcaller": "0x7ffbc5433f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-05-28 23:34:59,420", "thread_id": "2244", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000006e8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-05-28 23:34:59,420", "thread_id": "2244", "caller": "0x7ffbc5433d8e", "parentcaller": "0x7ffbc5433354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015d4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-05-28 23:34:59,420", "thread_id": "2244", "caller": "0x7ffbc5433395", "parentcaller": "0x7ffbc5433f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-05-28 23:34:59,420", "thread_id": "2244", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015d4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-05-28 23:34:59,420", "thread_id": "2244", "caller": "0x7ffbc5433d8e", "parentcaller": "0x7ffbc5433354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000006e8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-05-28 23:34:59,420", "thread_id": "2244", "caller": "0x7ffbc5433395", "parentcaller": "0x7ffbc5433f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-05-28 23:34:59,827", "thread_id": "1144", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015dc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-05-28 23:34:59,827", "thread_id": "1144", "caller": "0x7ffbc5433d8e", "parentcaller": "0x7ffbc5433354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015a8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-05-28 23:34:59,827", "thread_id": "1144", "caller": "0x7ffbc5433395", "parentcaller": "0x7ffbc5433f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1b4a73d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-05-28 23:35:00,561", "thread_id": "944", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc544e6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7ffbc4230000" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-05-28 23:35:00,624", "thread_id": "944", "caller": "0x7ffbc3137f97", "parentcaller": "0x7ffbc313b4bb", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001564" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001584" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-05-28 23:35:00,624", "thread_id": "940", "caller": "0x7ffbc3132c08", "parentcaller": "0x7ffbc314266e", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001588" }, { "name": "TargetProcessHandle", "value": "0x00001218" }, { "name": "TargetHandle", "value": "0x000009a4" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-05-28 23:35:00,624", "thread_id": "940", "caller": "0x7ffbc3132c42", "parentcaller": "0x7ffbc314266e", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000156c" }, { "name": "TargetProcessHandle", "value": "0x00001218" }, { "name": "TargetHandle", "value": "0x000009a0" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-05-28 23:35:00,624", "thread_id": "940", "caller": "0x7ffbc3132c77", "parentcaller": "0x7ffbc314266e", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000006a8" }, { "name": "TargetProcessHandle", "value": "0x00001218" }, { "name": "TargetHandle", "value": "0x000009a8" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-05-28 23:35:00,780", "thread_id": "944", "caller": "0x7ffbc5456579", "parentcaller": "0x7ffbc5455fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001500" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-05-28 23:35:03,639", "thread_id": "1000", "caller": "0x7ffbc544acfe", "parentcaller": "0x7ffbc6d59f03", "category": "services", "api": "StartServiceW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ServiceHandle", "value": "0x1b4a7522360" }, { "name": "ServiceName", "value": "MicrosoftEdgeElevationService" }, { "name": "Arguments", "value": [] } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-05-28 23:35:04,514", "thread_id": "1000", "caller": "0x7ffbc547c5f2", "parentcaller": "0x7ffbc54789f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000014b4" }, { "name": "ThreadHandle", "value": "0x00001510" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140716013527844" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-05-28 23:35:04,561", "thread_id": "1000", "caller": "0x7ffbc54789f3", "parentcaller": "0x7ffbc649de30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "CreationFlags", "value": "0x00000410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT" }, { "name": "ProcessId", "value": "8996" }, { "name": "ThreadId", "value": "9004" }, { "name": "ProcessHandle", "value": "0x000014b4" }, { "name": "ThreadHandle", "value": "0x00001510" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-05-28 23:35:09,311", "thread_id": "1000", "caller": "0x7ffbc31422bd", "parentcaller": "0x7ffbc304ce49", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001510" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000fd8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-05-28 23:35:09,311", "thread_id": "1000", "caller": "0x7ffbc31422bd", "parentcaller": "0x7ffbc304ce49", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001510" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000015d8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-05-28 23:35:09,311", "thread_id": "1000", "caller": "0x7ffbc3047024", "parentcaller": "0x7ffbc3047125", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000015d8" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001500" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-05-28 23:35:09,311", "thread_id": "1000", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc31d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000004c0" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001590" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-05-28 23:35:09,311", "thread_id": "1000", "caller": "0x7ffbc547c5f2", "parentcaller": "0x7ffbc54789f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000015a4" }, { "name": "ThreadHandle", "value": "0x000015c4" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\SystemApps\\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\\CHXSmartScreen.exe" }, { "name": "CommandLine", "value": "\"C:\\Windows\\SystemApps\\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\\CHXSmartScreen.exe\" -ServerName:App.AppXk7vvv12h4qrkhkbvf6j86ja45mzj5km9.mca" }, { "name": "DllPath", "value": "C:\\Windows\\SystemApps\\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy;" }, { "name": "ProcessId", "value": "140716013527684" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-05-28 23:35:09,342", "thread_id": "1000", "caller": "0x7ffbc54789f3", "parentcaller": "0x7ffbc649de30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\SystemApps\\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\\CHXSmartScreen.exe" }, { "name": "CommandLine", "value": "\"C:\\Windows\\SystemApps\\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\\CHXSmartScreen.exe\" -ServerName:App.AppXk7vvv12h4qrkhkbvf6j86ja45mzj5km9.mca" }, { "name": "CreationFlags", "value": "0x00080414", "pretty_value": "CREATE_SUSPENDED|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "8836" }, { "name": "ThreadId", "value": "10052" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x000015a4" }, { "name": "ThreadHandle", "value": "0x000015c4" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 78 } ], "threads": [ "1144", "420", "1108", "1000", "1088", "4372", "2244", "944", "940" ], "environ": { "UserName": "SYSTEM", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Windows\\TEMP\\", "CommandLine": "C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff6a8e20000", "MainExeSize": "0x00010000", "Bitness": "64-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } }, { "process_id": 8996, "process_name": "dllhost.exe", "parent_id": 844, "module_path": "C:\\Windows\\System32\\dllhost.exe", "first_seen": "2026-05-28 23:35:04,593", "calls": [ { "timestamp": "2026-05-28 23:35:04,656", "thread_id": "9004", "caller": "0x7ffbc7bc507d", "parentcaller": "0x7ffbc7bc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 0 }, { "timestamp": "2026-05-28 23:35:04,656", "thread_id": "9260", "caller": "0x7ffbc7baeb32", "parentcaller": "0x7ffbc7b677c3", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000038" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 3, "id": 1 }, { "timestamp": "2026-05-28 23:35:04,656", "thread_id": "9004", "caller": "0x7ff69bcf12f2", "parentcaller": "0x7ff69bcf13bb", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223abeb2000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-05-28 23:35:04,656", "thread_id": "9004", "caller": "0x7ff69bcf12f2", "parentcaller": "0x7ff69bcf13bb", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223abf4a000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-05-28 23:35:04,656", "thread_id": "9004", "caller": "0x7ff69bcf12f2", "parentcaller": "0x7ff69bcf13bb", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223abf53000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4 }, { "timestamp": "2026-05-28 23:35:04,656", "thread_id": "9004", "caller": "0x7ff69bcf1349", "parentcaller": "0x7ff69bcf13dc", "category": "hooking", "api": "SetUnhandledExceptionFilter", "status": true, "return": "0x00000001", "arguments": [ { "name": "ExceptionFilter", "value": "0x7ff69bcf1b60" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-05-28 23:35:04,656", "thread_id": "9252", "caller": "0x7ffbc7bc507d", "parentcaller": "0x7ffbc7bc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 6 }, { "timestamp": "2026-05-28 23:35:04,656", "thread_id": "9252", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ffb864a2030" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 7 }, { "timestamp": "2026-05-28 23:35:04,656", "thread_id": "9260", "caller": "0x7ffbc7bc507d", "parentcaller": "0x7ffbc7bc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 8 }, { "timestamp": "2026-05-28 23:35:04,656", "thread_id": "9260", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ffb864a1e10" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-05-28 23:35:04,656", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\system32\\rpcss.dll" }, { "name": "ModuleHandle", "value": "0x00000202" } ], "repeated": 0, "id": 10 }, { "timestamp": "2026-05-28 23:35:04,656", "thread_id": "9248", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223abf55000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-05-28 23:35:04,656", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-05-28 23:35:04,656", "thread_id": "9248", "caller": "0x7ffbc7bc507d", "parentcaller": "0x7ffbc7bc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 13 }, { "timestamp": "2026-05-28 23:35:04,656", "thread_id": "9248", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ffb864a1ed0" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-05-28 23:35:04,656", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000038" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-05-28 23:35:04,656", "thread_id": "9000", "caller": "0x7ffbc7bc507d", "parentcaller": "0x7ffbc7bc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 16 }, { "timestamp": "2026-05-28 23:35:04,656", "thread_id": "9000", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ffb864a1a00" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-05-28 23:35:04,656", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "42" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9004" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-05-28 23:35:04,656", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "kernel.appcore.dll" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-05-28 23:35:04,656", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-05-28 23:35:04,656", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000020c" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-05-28 23:35:04,656", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000208" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000020c" }, { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000208" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3110000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00012000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc311f000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3115000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 25 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3115000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3115000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3115000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3115000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000020c" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc3115000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\kernel.appcore" }, { "name": "DllBase", "value": "0x7ffbc3110000" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\kernel.appcore" }, { "name": "BaseAddress", "value": "0x7ffbc3110000" }, { "name": "InitRoutine", "value": "0x7ffbc3113f10" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000200" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "bcryptPrimitives.dll" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000200" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc5750000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00082000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc57b7000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc57b7000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc57b7000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc57b7000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc57b7000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000200" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc57b7000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\bcryptPrimitives" }, { "name": "DllBase", "value": "0x7ffbc5750000" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000204" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000204" }, { "name": "ValueName", "value": "STE" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000204" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000204" }, { "name": "ValueName", "value": "Enabled" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000001fc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000001fc" }, { "name": "ValueName", "value": "FipsAlgorithmPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000204" }, { "name": "ValueName", "value": "MDMEnabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001fc" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000001fc" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "\\Device\\CNG" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x000001fc" }, { "name": "IoControlCode", "value": "0x00390008", "pretty_value": "IOCTL_KSEC_RANDOM_FILL_BUFFER" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "6\\x89\\xbc\\xaf\\xab\\xe5\\xe6\\xc1\\x0eM\\x1d\\xd8$\\x8d&\rN\\x03\\x16# =\\xc7\\x19M6\\xc3>:\\x1f\\xd2Q0\\xe8\\xf2\\x13\\xa9\\x81\\xb1:\\x87T\\xa6\\x81y\\x96\\xf3\\xee" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\bcryptprimitives" }, { "name": "BaseAddress", "value": "0x7ffbc5750000" }, { "name": "InitRoutine", "value": "0x7ffbc5788b60" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc712e000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc712e000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf1153", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223abf57000" }, { "name": "RegionSize", "value": "0x00006000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" }, { "name": "FunctionName", "value": "CLSIDFromOle1Class" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc727f760" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000022c" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xf7\\x0f\\x0by\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\xc0h\\x86\\xfb\\x7f\\x00\\x00\\xa0\\xbdh\\x86\\xfb\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf0\\xf7\\x0f\\x0by\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xc0h\\x86" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000230" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\User\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bb3410" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" }, { "name": "MutexName", "value": "Local\\SM0:8996:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 76 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 78 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000022c" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\__ComCatalogCache__" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000022c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223ad9e0000" }, { "name": "SectionOffset", "value": "0x790b0ff810" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223abf5d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\COM3" }, { "name": "Handle", "value": "0x00000234" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\COM3" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" }, { "name": "ValueName", "value": "Com+Enabled" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000234" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "clbcatq.dll" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000234" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7a60000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000a9000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7b04000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7ad9000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7ad9000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7ad9000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7ad9000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7ad8000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7ad8000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\clbcatq" }, { "name": "DllBase", "value": "0x7ffbc7a60000" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "synchronization", "api": "NtOpenEvent", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" }, { "name": "EventName", "value": "\\KernelObjects\\MaximumCommitCondition" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\clbcatq" }, { "name": "BaseAddress", "value": "0x7ffbc7a60000" }, { "name": "InitRoutine", "value": "0x7ffbc7a7d990" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000023c" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\__ComCatalogCache__" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000023c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223ad9f0000" }, { "name": "SectionOffset", "value": "0x790b0ff560" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x00000242" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000242" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000242" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000242" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Thumbnail Cache Out of Proc Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000242" }, { "name": "ValueName", "value": "LocalService" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalService" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000242" }, { "name": "ValueName", "value": "DllSurrogate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000242" }, { "name": "ValueName", "value": "DllSurrogate" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000242" }, { "name": "ValueName", "value": "RunAs" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RunAs" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000242" }, { "name": "ValueName", "value": "ActivateAtStorage" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateAtStorage" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x00000246" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "ROTFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ROTFlags" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "AppIDFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppIDFlags" } ], "repeated": 0, "id": 119 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "MGOTFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\MGOTFlags" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "ProcessMitigationPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProcessMitigationPolicy" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000246" } ], "repeated": 0, "id": 122 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000242" }, { "name": "ValueName", "value": "LaunchPermission" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LaunchPermission" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE" }, { "name": "Handle", "value": "0x00000244" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE" } ], "repeated": 0, "id": 124 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "ValueName", "value": "LegacyAuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyAuthenticationLevel" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "ValueName", "value": "LegacyImpersonationLevel" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyImpersonationLevel" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000242" }, { "name": "ValueName", "value": "AuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AuthenticationLevel" } ], "repeated": 0, "id": 128 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000242" }, { "name": "ValueName", "value": "RemoteServerName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RemoteServerName" } ], "repeated": 0, "id": 129 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000242" }, { "name": "ValueName", "value": "SRPTrustLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\SRPTrustLevel" } ], "repeated": 0, "id": 130 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000242" }, { "name": "ValueName", "value": "PreferredServerBitness" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\PreferredServerBitness" } ], "repeated": 0, "id": 131 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000242" }, { "name": "ValueName", "value": "LoadUserSettings" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LoadUserSettings" } ], "repeated": 0, "id": 132 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xf0\\x0f\\x0by\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00B\\x02\\x00\\x00\\x00\\x00\\x00\\x00PQM\\xc7\\xfb\\x7f\\x00\\x00" } ], "repeated": 0, "id": 133 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000244" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 134 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000244" }, { "name": "SubKey", "value": "Software\\Classes" }, { "name": "Handle", "value": "0x00000248" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\" }, { "name": "NotifyFilter", "value": "0x10000005" }, { "name": "WatchSubtree", "value": "1" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 137 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000242" }, { "name": "ValueName", "value": "ProtectionLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProtectionLevel" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000242" } ], "repeated": 0, "id": 139 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 140 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 141 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 142 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223abf5e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 143 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7b593b0" } ], "repeated": 0, "id": 144 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7befc40" } ], "repeated": 0, "id": 145 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7b92460" } ], "repeated": 0, "id": 146 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bacbd0" } ], "repeated": 0, "id": 147 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "164" } ], "repeated": 0, "id": 148 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000024c" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx" } ], "repeated": 0, "id": 149 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000024c" }, { "name": "ValueName", "value": "AllowDevelopmentWithoutDevLicense" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense" } ], "repeated": 0, "id": 150 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 151 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000024c" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock" } ], "repeated": 0, "id": 152 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000024c" }, { "name": "ValueName", "value": "AllowDevelopmentWithoutDevLicense" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense" } ], "repeated": 0, "id": 153 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 154 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" } ], "repeated": 0, "id": 155 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7b593b0" } ], "repeated": 0, "id": 156 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7befc40" } ], "repeated": 0, "id": 157 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7b92460" } ], "repeated": 0, "id": 158 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bcfa30" } ], "repeated": 0, "id": 159 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bacbd0" } ], "repeated": 0, "id": 160 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223abf5f000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 161 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE\\AppCompat" }, { "name": "Handle", "value": "0x0000024c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat" } ], "repeated": 0, "id": 162 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000024c" }, { "name": "ValueName", "value": "RaiseActivationAuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel" } ], "repeated": 0, "id": 163 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 164 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000024c" } ], "repeated": 0, "id": 165 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 166 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 167 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xef\\x0f\\x0by\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\xc0h\\x86\\xfb\\x7f\\x00\\x00\\xa0\\xbdh\\x86\\xfb\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\xf0\\x0f\\x0by\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xc0h\\x86" } ], "repeated": 0, "id": 168 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000250" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\User\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes" } ], "repeated": 0, "id": 169 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 170 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000252" }, { "name": "SubKey", "value": "AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x0000024e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 171 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000024e" }, { "name": "ValueName", "value": "AuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AuthenticationLevel" } ], "repeated": 0, "id": 172 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE\\AppCompat" }, { "name": "Handle", "value": "0x00000254" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat" } ], "repeated": 0, "id": 173 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000254" }, { "name": "ValueName", "value": "RaiseDefaultAuthnLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel" } ], "repeated": 0, "id": 174 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 175 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000024e" }, { "name": "ValueName", "value": "AccessPermission" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AccessPermission" } ], "repeated": 0, "id": 176 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024e" } ], "repeated": 0, "id": 177 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\OLE" }, { "name": "Handle", "value": "0x0000024c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE" } ], "repeated": 0, "id": 178 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000024c" }, { "name": "ValueName", "value": "DefaultAccessPermission" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\DefaultAccessPermission" } ], "repeated": 0, "id": 179 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000254" } ], "repeated": 0, "id": 180 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 181 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xb0\\xcb\\xf5\\xab#\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00" } ], "repeated": 0, "id": 182 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 183 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\system32\\rpcss.dll" }, { "name": "ModuleHandle", "value": "0x00002100" } ], "repeated": 0, "id": 184 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 185 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xf4\\x0f\\x0by\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6CE\\xc5\\xfb\\x7f\\x00\\x00W\\x10\\x86\\xe7\\xf5\\xf5\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 186 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 187 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 188 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 189 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223abf61000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 190 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 191 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 192 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 193 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 194 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x00002324" }, { "name": "EventName", "value": "MSFT.VSA.COM.DISABLE.8996" } ], "repeated": 0, "id": 195 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x00000000" }, { "name": "EventName", "value": "MSFT.VSA.IEC.STATUS.6c736db0" } ], "repeated": 0, "id": 196 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223abf63000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 197 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000252" }, { "name": "SubKey", "value": "Interface\\{00000134-0000-0000-C000-000000000046}" }, { "name": "Handle", "value": "0x00000262" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 198 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000262" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000266" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32" } ], "repeated": 0, "id": 199 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000266" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{00000320-0000-0000-C000-000000000046}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 200 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000266" } ], "repeated": 0, "id": 201 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000262" } ], "repeated": 0, "id": 202 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000260" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE\\Software\\Microsoft\\Rpc\\Extensions" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc\\Extensions" } ], "repeated": 0, "id": 203 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000260" }, { "name": "ValueName", "value": "NdrOleExtDLL" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "combase.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\Extensions\\NdrOleExtDLL" } ], "repeated": 0, "id": 204 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" } ], "repeated": 0, "id": 205 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" } ], "repeated": 0, "id": 206 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" }, { "name": "FunctionName", "value": "NdrOleInitializeExtension" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc72a4240" } ], "repeated": 0, "id": 207 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" }, { "name": "FunctionName", "value": "CoMarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc724b0b0" } ], "repeated": 0, "id": 208 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" }, { "name": "FunctionName", "value": "CoUnmarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7248b50" } ], "repeated": 0, "id": 209 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" }, { "name": "FunctionName", "value": "StringFromIID" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7279780" } ], "repeated": 0, "id": 210 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" }, { "name": "FunctionName", "value": "CoTaskMemAlloc" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7282e80" } ], "repeated": 0, "id": 211 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" }, { "name": "FunctionName", "value": "CoTaskMemFree" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7281b70" } ], "repeated": 0, "id": 212 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" }, { "name": "FunctionName", "value": "CoCreateInstance" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc71fa420" } ], "repeated": 0, "id": 213 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" }, { "name": "FunctionName", "value": "CoReleaseMarshalData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc71fe790" } ], "repeated": 0, "id": 214 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223abf65000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 215 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 216 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000260" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 217 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000264" } ], "repeated": 0, "id": 218 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x82\\x1a\\x0b\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xe2q\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 219 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x18d\\xf5\\xab#\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 220 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`c\\xf5\\xab#\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 221 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 222 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xa8\\xcb\\xf5\\xab#\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 223 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 224 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x98b\\xf5\\xab#\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 225 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00\\xa7\\x1d\\x86\\xe7\\xf5\\xf5\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00\\xc0\\xea\\x0f\\x0by\\x00\\x00\\x00\\xb8\\xea\\x0f\\x0by\\x00\\x00\\x00\\x88\\xea\\x0f\\x0by\\x00\\x00\\x00\\xa8\\xea\\x0f\\x0b" } ], "repeated": 0, "id": 226 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90b\\xf5\\xab#\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xa8\\xe8\\x0f\\x0by\\x00\\x00\\x00d\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 227 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x82\\x1a\\x0b\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xe2q\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 228 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xd8^\\xf5\\xab#\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 229 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "@_\\xf5\\xab#\\x02\\x00\\x00`\\x00\\x00\\x00\\\\x00W\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00k\\x00e\\x00r\\x00n\\x00e\\x00l\\x00.\\x00a\\x00p\\x00p\\x00c\\x00o\\x00r\\x00e\\x00.\\x00d\\x00l\\x00l\\x00" } ], "repeated": 0, "id": 230 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 231 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "h\\xd2\\xf5\\xab#\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 232 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 233 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x98_\\xf5\\xab#\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 234 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00G!\\x86\\xe7\\xf5\\xf5\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00 \\xe7\\x0f\\x0by\\x00\\x00\\x00\\x18\\xe7\\x0f\\x0by\\x00\\x00\\x00\\xe8\\xe6\\x0f\\x0by\\x00\\x00\\x00\\x08\\xe7\\x0f\\x0b" } ], "repeated": 0, "id": 235 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90_\\xf5\\xab#\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x08\\xe5\\x0f\\x0by\\x00\\x00\\x00d\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 236 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" } ], "repeated": 0, "id": 237 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000264" } ], "repeated": 0, "id": 238 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 239 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" } ], "repeated": 0, "id": 240 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000268" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x7ffbc7272d30" }, { "name": "Parameter", "value": "0x223abf46d10" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "8664" }, { "name": "ProcessId", "value": "8996" }, { "name": "Module", "value": "combase.dll" } ], "repeated": 0, "id": 241 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000268", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffbc7272d30" }, { "name": "Parameter", "value": "0x223abf46d10" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "8664" }, { "name": "ProcessId", "value": "8996" } ], "repeated": 0, "id": 242 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 243 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "8664", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223abf68000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "yes" } ], "repeated": 0, "id": 244 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 245 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000268" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 246 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "8664", "caller": "0x7ffbc7bc507d", "parentcaller": "0x7ffbc7bc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 247 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000270" } ], "repeated": 0, "id": 248 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "8664", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ffbc7272d30" }, { "name": "Parameter", "value": "0x223abf46d10" } ], "repeated": 0, "id": 249 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x82\\x1a\\x0b\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xe2q\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 250 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x18d\\xf5\\xab#\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 251 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xa0b\\xf5\\xab#\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 252 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 253 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xb8\\xd0\\xf5\\xab#\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 254 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 255 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd8^\\xf5\\xab#\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 256 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00\\xf7\\x19\\x86\\xe7\\xf5\\xf5\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00\\x90\\xee\\x0f\\x0by\\x00\\x00\\x00\\x88\\xee\\x0f\\x0by\\x00\\x00\\x00X\\xee\\x0f\\x0by\\x00\\x00\\x00x\\xee\\x0f\\x0b" } ], "repeated": 0, "id": 257 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0^\\xf5\\xab#\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xec\\x0f\\x0by\\x00\\x00\\x00p\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 258 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x82\\x1a\\x0b\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xe2q\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 259 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "Xc\\xf5\\xab#\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 260 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "``\\xf5\\xab#\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 261 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 262 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xe8\\xd0\\xf5\\xab#\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 263 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 264 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "8_\\xf5\\xab#\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 265 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00\\x97\\x1d\\x86\\xe7\\xf5\\xf5\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00\\xf0\\xea\\x0f\\x0by\\x00\\x00\\x00\\xe8\\xea\\x0f\\x0by\\x00\\x00\\x00\\xb8\\xea\\x0f\\x0by\\x00\\x00\\x00\\xd8\\xea\\x0f\\x0b" } ], "repeated": 0, "id": 266 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000_\\xf5\\xab#\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd8\\xe8\\x0f\\x0by\\x00\\x00\\x00p\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 267 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 268 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000270" } ], "repeated": 0, "id": 269 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 270 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000270" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 271 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000268" } ], "repeated": 0, "id": 272 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x82\\x1a\\x0b\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xe2q\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 273 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "8_\\xf5\\xab#\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05" } ], "repeated": 0, "id": 274 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`c\\xf5\\xab#\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 275 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 276 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x98\\xcc\\xf5\\xab#\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 277 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 278 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x18d\\xf5\\xab#\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 279 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00\\xf7\\x19\\x86\\xe7\\xf5\\xf5\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00\\x90\\xee\\x0f\\x0by\\x00\\x00\\x00\\x88\\xee\\x0f\\x0by\\x00\\x00\\x00X\\xee\\x0f\\x0by\\x00\\x00\\x00x\\xee\\x0f\\x0b" } ], "repeated": 0, "id": 280 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10d\\xf5\\xab#\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xec\\x0f\\x0by\\x00\\x00\\x00h\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 281 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x82\\x1a\\x0b\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xe2q\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 282 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xd8^\\xf5\\xab#\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05" } ], "repeated": 0, "id": 283 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xa0b\\xf5\\xab#\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 284 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 285 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xb8\\xd0\\xf5\\xab#\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 286 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 287 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "X`\\xf5\\xab#\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 288 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00\\x97\\x1d\\x86\\xe7\\xf5\\xf5\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00\\xf0\\xea\\x0f\\x0by\\x00\\x00\\x00\\xe8\\xea\\x0f\\x0by\\x00\\x00\\x00\\xb8\\xea\\x0f\\x0by\\x00\\x00\\x00\\xd8\\xea\\x0f\\x0b" } ], "repeated": 0, "id": 289 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P`\\xf5\\xab#\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd8\\xe8\\x0f\\x0by\\x00\\x00\\x00h\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 290 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000270" } ], "repeated": 0, "id": 291 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 292 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 293 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000268" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 294 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000270" } ], "repeated": 0, "id": 295 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x82\\x1a\\x0b\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xe2q\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 296 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "X`\\xf5\\xab#\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05" } ], "repeated": 0, "id": 297 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xa0b\\xf5\\xab#\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 298 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 299 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xb8\\xd0\\xf5\\xab#\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 300 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 301 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "Xc\\xf5\\xab#\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 302 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00\\xf7\\x19\\x86\\xe7\\xf5\\xf5\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00\\x90\\xee\\x0f\\x0by\\x00\\x00\\x00\\x88\\xee\\x0f\\x0by\\x00\\x00\\x00X\\xee\\x0f\\x0by\\x00\\x00\\x00x\\xee\\x0f\\x0b" } ], "repeated": 0, "id": 303 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Pc\\xf5\\xab#\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xec\\x0f\\x0by\\x00\\x00\\x00p\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 304 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x82\\x1a\\x0b\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xe2q\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 305 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xd8^\\xf5\\xab#\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05" } ], "repeated": 0, "id": 306 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "@_\\xf5\\xab#\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 307 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 308 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xe8\\xd0\\xf5\\xab#\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 309 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 310 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x18d\\xf5\\xab#\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 311 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00\\x97\\x1d\\x86\\xe7\\xf5\\xf5\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00\\xf0\\xea\\x0f\\x0by\\x00\\x00\\x00\\xe8\\xea\\x0f\\x0by\\x00\\x00\\x00\\xb8\\xea\\x0f\\x0by\\x00\\x00\\x00\\xd8\\xea\\x0f\\x0b" } ], "repeated": 0, "id": 312 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10d\\xf5\\xab#\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd8\\xe8\\x0f\\x0by\\x00\\x00\\x00p\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 313 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 314 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000270" } ], "repeated": 0, "id": 315 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 316 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000270" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 317 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000268" } ], "repeated": 0, "id": 318 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x82\\x1a\\x0b\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xe2q\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 319 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x98b\\xf5\\xab#\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05" } ], "repeated": 0, "id": 320 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": " d\\xf5\\xab#\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 321 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 322 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x08\\xcf\\xf5\\xab#\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 323 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 324 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "8_\\xf5\\xab#\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 325 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00\\xf7\\x19\\x86\\xe7\\xf5\\xf5\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00\\x90\\xee\\x0f\\x0by\\x00\\x00\\x00\\x88\\xee\\x0f\\x0by\\x00\\x00\\x00X\\xee\\x0f\\x0by\\x00\\x00\\x00x\\xee\\x0f\\x0b" } ], "repeated": 0, "id": 326 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000_\\xf5\\xab#\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xec\\x0f\\x0by\\x00\\x00\\x00h\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 327 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x82\\x1a\\x0b\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xe2q\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 328 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xd8^\\xf5\\xab#\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05" } ], "repeated": 0, "id": 329 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xa0_\\xf5\\xab#\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 330 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 331 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xe8\\xd0\\xf5\\xab#\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 332 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 333 }, { "timestamp": "2026-05-28 23:35:04,671", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "Xc\\xf5\\xab#\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 334 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00\\x97\\x1d\\x86\\xe7\\xf5\\xf5\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00\\xf0\\xea\\x0f\\x0by\\x00\\x00\\x00\\xe8\\xea\\x0f\\x0by\\x00\\x00\\x00\\xb8\\xea\\x0f\\x0by\\x00\\x00\\x00\\xd8\\xea\\x0f\\x0b" } ], "repeated": 0, "id": 335 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Pc\\xf5\\xab#\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd8\\xe8\\x0f\\x0by\\x00\\x00\\x00h\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 336 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000270" } ], "repeated": 0, "id": 337 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 338 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 339 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223abf69000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 340 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc7bc507d", "parentcaller": "0x7ffbc7bc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 341 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ffbc7ba2b30" }, { "name": "Parameter", "value": "0x223abf20b50" } ], "repeated": 0, "id": 342 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc703ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000284" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 343 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223abf6a000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 344 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" } ], "repeated": 0, "id": 345 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8700", "caller": "0x7ffbc7bc507d", "parentcaller": "0x7ffbc7bc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 346 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8700", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ffbc7ba2b30" }, { "name": "Parameter", "value": "0x223abf20b50" } ], "repeated": 0, "id": 347 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8700", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223abf6c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 348 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x0000028c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x7ffbc7272d30" }, { "name": "Parameter", "value": "0x223abf46c90" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "8716" }, { "name": "ProcessId", "value": "8996" }, { "name": "Module", "value": "combase.dll" } ], "repeated": 0, "id": 349 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x0000028c", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffbc7272d30" }, { "name": "Parameter", "value": "0x223abf46c90" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "8716" }, { "name": "ProcessId", "value": "8996" } ], "repeated": 0, "id": 350 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" } ], "repeated": 0, "id": 351 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000270" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 352 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bc507d", "parentcaller": "0x7ffbc7bc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 353 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ffbc7272d30" }, { "name": "Parameter", "value": "0x223abf46c90" } ], "repeated": 0, "id": 354 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223abf6d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 355 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7b97830", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 356 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7b97881", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 357 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc77d2b57", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\uxtheme" }, { "name": "DllBase", "value": "0x7ffbc2bf0000" } ], "repeated": 0, "id": 358 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc77d2b57", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\uxtheme.dll" }, { "name": "BaseAddress", "value": "0x7ffbc2bf0000" } ], "repeated": 0, "id": 359 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc77d2b57", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc2bf0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\system32\\uxtheme.dll" }, { "name": "dwFlags", "value": "0x00000008" } ], "repeated": 0, "id": 360 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbc77d2bbb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "uxtheme.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc2bf0000" }, { "name": "FunctionName", "value": "ThemeInitApiHook" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc2bfcde0" } ], "repeated": 0, "id": 361 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc2bfce20", "parentcaller": "0x7ffbc77d2d8c", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 362 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc7b667b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xe8\\xbf\\x0by\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 363 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7b667ec", "parentcaller": "0x7ffbc5435140", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 364 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc5453f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 365 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc5453f76", "parentcaller": "0x7ffbc54d4fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002ac" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002a8" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 366 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc5452fe4", "parentcaller": "0x7ffbc2c2d921", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" }, { "name": "ValueName", "value": "AppsUseLightTheme" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme" } ], "repeated": 0, "id": 367 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc5453018", "parentcaller": "0x7ffbc2c2d921", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 368 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc2bfd96c", "parentcaller": "0x7ffbc2bfd1d1", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 369 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc5486f4c", "parentcaller": "0x7ffbc703ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000002b0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 370 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223abf6e000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 371 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7b93f7a", "parentcaller": "0x7ffbc7020ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 372 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7020cd1", "parentcaller": "0x7ffbc701f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000002b4" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 373 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc549026b", "parentcaller": "0x7ffbc7020daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002b8" } ], "repeated": 0, "id": 374 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7b88cde", "parentcaller": "0x7ffbc7bc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x82\\x1a\\x0b\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xe2q\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 375 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb6e46", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "(\\xd3\\xf2\\xab#\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 376 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb6e9b", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "P\\xd1\\xf2\\xab#\\x02\\x00\\x00`\\x00\\x00\\x00#\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00#\\x02\\x00\\x00\\xf00\\xf2\\xab#\\x02\\x00\\x00\\xf00\\xf2\\xab#\\x02\\x00\\x00\\xf00\\xf2\\xab#\\x02\\x00\\x00\\x80$\\xf2\\xab#\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x00\\x01\\x0f\\x10\\x1f\\x00\\x08\\x16\\x00\\x18\\x00" } ], "repeated": 0, "id": 377 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb6ec0", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 378 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb6f0e", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xe8\\xca\\xf5\\xab#\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 379 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb6f37", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 380 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223abf70000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 381 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb6f8f", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x98\\xfb\\xf6\\xab#\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 382 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb7048", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x007\\x1e6\\xe7\\xf5\\xf5\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00P\\xea\\xbf\\x0by\\x00\\x00\\x00H\\xea\\xbf\\x0by\\x00\\x00\\x00\\x18\\xea\\xbf\\x0by\\x00\\x00\\x008\\xea\\xbf\\x0b" } ], "repeated": 0, "id": 383 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb707b", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfb\\xf6\\xab#\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xe8\\xbf\\x0by\\x00\\x00\\x00\\xb8\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 384 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7b88cde", "parentcaller": "0x7ffbc7b8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x82\\x1a\\x0b\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xe2q\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 385 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb6e46", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "x\\x00\\xf7\\xab#\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 386 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb6e9b", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xa0\\x01\\xf7\\xab#\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 387 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb6ec0", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 388 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb6f0e", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xb8\\xd0\\xf5\\xab#\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 389 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb6f37", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 390 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb6f8f", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xf8\\xfb\\xf6\\xab#\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 391 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb7048", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00\\xd7!6\\xe7\\xf5\\xf5\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00\\xb0\\xe6\\xbf\\x0by\\x00\\x00\\x00\\xa8\\xe6\\xbf\\x0by\\x00\\x00\\x00x\\xe6\\xbf\\x0by\\x00\\x00\\x00\\x98\\xe6\\xbf\\x0b" } ], "repeated": 0, "id": 392 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb707b", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfb\\xf6\\xab#\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xe4\\xbf\\x0by\\x00\\x00\\x00\\xb8\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 393 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223abf71000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 394 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7020e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 395 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7020e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 396 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 397 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x0000028c" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 398 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002a0" } ], "repeated": 0, "id": 399 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x82\\x1a\\x0b\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xe2q\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 400 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x18d\\xf5\\xab#\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05" } ], "repeated": 0, "id": 401 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`c\\xf5\\xab#\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 402 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 403 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x98\\xcc\\xf5\\xab#\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 404 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 405 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd8^\\xf5\\xab#\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 406 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00\\x87\\x1c\\x86\\xe7\\xf5\\xf5\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00\\xe0\\xeb\\x0f\\x0by\\x00\\x00\\x00\\xd8\\xeb\\x0f\\x0by\\x00\\x00\\x00\\xa8\\xeb\\x0f\\x0by\\x00\\x00\\x00\\xc8\\xeb\\x0f\\x0b" } ], "repeated": 0, "id": 407 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0^\\xf5\\xab#\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xc8\\xe9\\x0f\\x0by\\x00\\x00\\x00\\xa0\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 408 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x82\\x1a\\x0b\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xe2q\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 409 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "8_\\xf5\\xab#\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05" } ], "repeated": 0, "id": 410 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xa0_\\xf5\\xab#\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 411 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 412 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x18\\xcb\\xf5\\xab#\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 413 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 414 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xf8_\\xf5\\xab#\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 415 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00' \\x86\\xe7\\xf5\\xf5\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00@\\xe8\\x0f\\x0by\\x00\\x00\\x008\\xe8\\x0f\\x0by\\x00\\x00\\x00\\x08\\xe8\\x0f\\x0by\\x00\\x00\\x00(\\xe8\\x0f\\x0b" } ], "repeated": 0, "id": 416 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0_\\xf5\\xab#\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00(\\xe6\\x0f\\x0by\\x00\\x00\\x00\\xa0\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 417 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" } ], "repeated": 0, "id": 418 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a0" } ], "repeated": 0, "id": 419 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x000002a0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x7ffbc72b7db0" }, { "name": "Parameter", "value": "0x223abf5c5c0" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "8712" }, { "name": "ProcessId", "value": "8996" }, { "name": "Module", "value": "combase.dll" } ], "repeated": 0, "id": 420 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x000002a0", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ffbc72b7db0" }, { "name": "Parameter", "value": "0x223abf5c5c0" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "8712" }, { "name": "ProcessId", "value": "8996" } ], "repeated": 0, "id": 421 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 422 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a0" }, { "name": "Milliseconds", "value": "20000" } ], "repeated": 0, "id": 423 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8712", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223abf74000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 424 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8712", "caller": "0x7ffbc7bc507d", "parentcaller": "0x7ffbc7bc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 425 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8712", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ffbc72b7db0" }, { "name": "Parameter", "value": "0x223abf5c5c0" } ], "repeated": 0, "id": 426 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8712", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc72b7dc9", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 427 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8712", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc72b7dc9", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000021c" }, { "name": "Milliseconds", "value": "30000" } ], "repeated": 0, "id": 428 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8712", "caller": "0x7ffbc7ba467e", "parentcaller": "0x7ffbc649734d", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "8712" } ], "repeated": 0, "id": 429 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8712", "caller": "0x7ffbc7ba469e", "parentcaller": "0x7ffbc649734d", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 430 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a0" } ], "repeated": 0, "id": 431 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 432 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223abf75000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 433 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc54554eb", "parentcaller": "0x7ffbc71f8ce0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xb4\\x1f\\x0b\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xe2q\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 434 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc71f8c8a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 435 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc727d427", "parentcaller": "0x7ffbc71f3d82", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x223abf22268", "arguments": [ { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 436 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbc72a42bf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" }, { "name": "FunctionName", "value": "CoMarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc724b0b0" } ], "repeated": 0, "id": 437 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbc72a42e9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" }, { "name": "FunctionName", "value": "CoUnmarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7248b50" } ], "repeated": 0, "id": 438 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbc72a4313", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" }, { "name": "FunctionName", "value": "StringFromIID" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7279780" } ], "repeated": 0, "id": 439 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbc72a433d", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" }, { "name": "FunctionName", "value": "CoTaskMemAlloc" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7282e80" } ], "repeated": 0, "id": 440 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbc72a4367", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" }, { "name": "FunctionName", "value": "CoTaskMemFree" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7281b70" } ], "repeated": 0, "id": 441 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbc72a4391", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" }, { "name": "FunctionName", "value": "CoCreateInstance" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc71fa420" } ], "repeated": 0, "id": 442 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbc72a43bb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" }, { "name": "FunctionName", "value": "CoReleaseMarshalData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc71fe790" } ], "repeated": 0, "id": 443 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc72a41cf", "parentcaller": "0x7ffbc7b938c0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000032A-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000149-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 444 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc54554eb", "parentcaller": "0x7ffbc722b0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 445 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc728224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 446 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc7207b74", "parentcaller": "0x7ffbc72053d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x000002c6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 447 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002c6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 448 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002c6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 449 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xca\\x9f\\x0by\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00\\xc6\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00y\\x00\\x00\\x00\\x90\\xcb\\x9f\\x0by\\x00\\x00\\x00" } ], "repeated": 0, "id": 450 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" } ], "repeated": 0, "id": 451 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002c6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 452 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002c6" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" } ], "repeated": 0, "id": 453 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc72922e1", "parentcaller": "0x7ffbc7207c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002c6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 454 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72081f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002c6" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 455 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c6" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 456 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72087bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Thumbnail Cache Class Factory for Out of Proc Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 457 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc7208485", "parentcaller": "0x7ffbc720829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002c6" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000002ca" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32" } ], "repeated": 0, "id": 458 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ca" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\InprocServer32" } ], "repeated": 0, "id": 459 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ca" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 460 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72087bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ca" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\thumbcache.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 461 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7208d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ca" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Apartment" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\ThreadingModel" } ], "repeated": 0, "id": 462 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc720855f", "parentcaller": "0x7ffbc720829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ca" } ], "repeated": 0, "id": 463 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002c6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 464 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002c6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 465 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xc9\\x9f\\x0by\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00\\xc6\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00y\\x00\\x00\\x00 \\xca\\x9f\\x0by\\x00\\x00\\x00" } ], "repeated": 0, "id": 466 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" } ], "repeated": 0, "id": 467 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002c6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 468 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002c6" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" } ], "repeated": 0, "id": 469 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002c6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 470 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002c6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 471 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xc9\\x9f\\x0by\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00\\xc6\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00y\\x00\\x00\\x00 \\xca\\x9f\\x0by\\x00\\x00\\x00" } ], "repeated": 0, "id": 472 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" } ], "repeated": 0, "id": 473 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002c6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 474 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002c6" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" } ], "repeated": 0, "id": 475 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc7208010", "parentcaller": "0x7ffbc72053d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c6" } ], "repeated": 0, "id": 476 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc72794b2", "parentcaller": "0x7ffbc72654b4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE" }, { "name": "Handle", "value": "0x000002c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE" } ], "repeated": 0, "id": 477 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc72794ea", "parentcaller": "0x7ffbc72654b4", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002c4" }, { "name": "ValueName", "value": "MaxSxSHashCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount" } ], "repeated": 0, "id": 478 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc7279503", "parentcaller": "0x7ffbc72654b4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c4" } ], "repeated": 0, "id": 479 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc727de68", "parentcaller": "0x7ffbc72371ff", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\COM3" }, { "name": "Handle", "value": "0x000002c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3" } ], "repeated": 0, "id": 480 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc727dea4", "parentcaller": "0x7ffbc72371ff", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002c4" }, { "name": "ValueName", "value": "GipActivityBypass" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\GipActivityBypass" } ], "repeated": 0, "id": 481 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc727debd", "parentcaller": "0x7ffbc72371ff", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c4" } ], "repeated": 0, "id": 482 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc7250e98", "parentcaller": "0x7ffbc7252cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000304b8" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 483 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7b93f7a", "parentcaller": "0x7ffbc7020ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 484 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7020cd1", "parentcaller": "0x7ffbc701f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000002d0" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 485 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc549026b", "parentcaller": "0x7ffbc7020daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002d4" } ], "repeated": 0, "id": 486 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7b88cde", "parentcaller": "0x7ffbc7bc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x82\\x1a\\x0b\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xe2q\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 487 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb6e46", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x98\\x9a\\xf7\\xab#\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 488 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb6e9b", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00\\x98\\xf7\\xab#\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 489 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb6ec0", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 490 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb6f0e", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x08\\xcc\\xf5\\xab#\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 491 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb6f37", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 492 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb6f8f", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "X\\x98\\xf7\\xab#\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 493 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb7048", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00g36\\xe7\\xf5\\xf5\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00\\x00\\xd5\\xbf\\x0by\\x00\\x00\\x00\\xf8\\xd4\\xbf\\x0by\\x00\\x00\\x00\\xc8\\xd4\\xbf\\x0by\\x00\\x00\\x00\\xe8\\xd4\\xbf\\x0b" } ], "repeated": 0, "id": 494 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb707b", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x98\\xf7\\xab#\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd2\\xbf\\x0by\\x00\\x00\\x00\\xd4\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 495 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223abf7a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 496 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7b88cde", "parentcaller": "0x7ffbc7b8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x82\\x1a\\x0b\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xe2q\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 497 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb6e46", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xd8\\x99\\xf7\\xab#\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 498 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb6e9b", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x80\\x9c\\xf7\\xab#\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 499 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb6ec0", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 500 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb6f0e", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x18\\xcb\\xf5\\xab#\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 501 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb6f37", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 502 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb6f8f", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xb8\\x98\\xf7\\xab#\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 503 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb7048", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00\\x0776\\xe7\\xf5\\xf5\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00`\\xd1\\xbf\\x0by\\x00\\x00\\x00X\\xd1\\xbf\\x0by\\x00\\x00\\x00(\\xd1\\xbf\\x0by\\x00\\x00\\x00H\\xd1\\xbf\\x0b" } ], "repeated": 0, "id": 504 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7bb707b", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x98\\xf7\\xab#\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xcf\\xbf\\x0by\\x00\\x00\\x00\\xd4\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 505 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7020e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" } ], "repeated": 0, "id": 506 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7020e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" } ], "repeated": 0, "id": 507 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc549c06d", "parentcaller": "0x7ffbc544d794", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223ada00000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 508 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc544ed78", "parentcaller": "0x7ffbc54a06f5", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 509 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc544dbb1", "parentcaller": "0x7ffbc544d381", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 510 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc544dda6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" }, { "name": "Milliseconds", "value": "4000" } ], "repeated": 0, "id": 511 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc549c06d", "parentcaller": "0x7ffbc544dcda", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223ada10000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 512 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc544dd5d", "parentcaller": "0x7ffbc544dd0d", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" } ], "repeated": 0, "id": 513 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8708", "caller": "0x7ffbc7250e98", "parentcaller": "0x7ffbc7252cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000304b8" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 514 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc7281dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 515 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7207b74", "parentcaller": "0x7ffbc72053d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x000002d2" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 516 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 517 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 518 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xcb\\xbf\\x0by\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00\\xd2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00y\\x00\\x00\\x00\\xb0\\xcc\\xbf\\x0by\\x00\\x00\\x00" } ], "repeated": 0, "id": 519 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" } ], "repeated": 0, "id": 520 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 521 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d2" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" } ], "repeated": 0, "id": 522 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc72922e1", "parentcaller": "0x7ffbc7207c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 523 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72081f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002d2" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 524 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d2" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 525 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72087bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Thumbnail Cache Class Factory for Out of Proc Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 526 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7208485", "parentcaller": "0x7ffbc720829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002d2" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000002da" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32" } ], "repeated": 0, "id": 527 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002da" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\InprocServer32" } ], "repeated": 0, "id": 528 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002da" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 529 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72087bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002da" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\thumbcache.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 530 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7208d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002da" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Apartment" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\ThreadingModel" } ], "repeated": 0, "id": 531 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc720855f", "parentcaller": "0x7ffbc720829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002da" } ], "repeated": 0, "id": 532 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 533 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 534 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xca\\xbf\\x0by\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00\\xd2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00y\\x00\\x00\\x00@\\xcb\\xbf\\x0by\\x00\\x00\\x00" } ], "repeated": 0, "id": 535 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" } ], "repeated": 0, "id": 536 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 537 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d2" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" } ], "repeated": 0, "id": 538 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 539 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 540 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xca\\xbf\\x0by\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00\\xd2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00y\\x00\\x00\\x00@\\xcb\\xbf\\x0by\\x00\\x00\\x00" } ], "repeated": 0, "id": 541 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" } ], "repeated": 0, "id": 542 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 543 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d2" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" } ], "repeated": 0, "id": 544 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc720ab08", "parentcaller": "0x7ffbc720a7d9", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002d2" }, { "name": "SubKey", "value": "LocalServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalServer32" } ], "repeated": 0, "id": 545 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720a825", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d2" }, { "name": "ValueName", "value": "AppID" }, { "name": "Data", "value": "{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppID" } ], "repeated": 0, "id": 546 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc72a5483", "parentcaller": "0x7ffbc7224bdc", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x000002da" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 547 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc72922e1", "parentcaller": "0x7ffbc7224c07", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002da" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 548 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002da" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 549 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72087bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002da" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Thumbnail Cache Out of Proc Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 550 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002da" }, { "name": "ValueName", "value": "LocalService" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalService" } ], "repeated": 0, "id": 551 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002da" }, { "name": "ValueName", "value": "DllSurrogate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate" } ], "repeated": 0, "id": 552 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72087bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002da" }, { "name": "ValueName", "value": "DllSurrogate" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate" } ], "repeated": 0, "id": 553 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7209bff", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002da" }, { "name": "ValueName", "value": "RunAs" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RunAs" } ], "repeated": 0, "id": 554 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7209d1a", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002da" }, { "name": "ValueName", "value": "ActivateAtStorage" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateAtStorage" } ], "repeated": 0, "id": 555 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7209e39", "parentcaller": "0x7ffbc7224dd5", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x000002de" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 556 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7209e8d", "parentcaller": "0x7ffbc7224dd5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002de" }, { "name": "ValueName", "value": "ROTFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ROTFlags" } ], "repeated": 0, "id": 557 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7209ee0", "parentcaller": "0x7ffbc7224dd5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002de" }, { "name": "ValueName", "value": "AppIDFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppIDFlags" } ], "repeated": 0, "id": 558 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7209f30", "parentcaller": "0x7ffbc7224dd5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002de" }, { "name": "ValueName", "value": "MGOTFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\MGOTFlags" } ], "repeated": 0, "id": 559 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7209f84", "parentcaller": "0x7ffbc7224dd5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002de" }, { "name": "ValueName", "value": "ProcessMitigationPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProcessMitigationPolicy" } ], "repeated": 0, "id": 560 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7209fa7", "parentcaller": "0x7ffbc7224dd5", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002de" } ], "repeated": 0, "id": 561 }, { "timestamp": "2026-05-28 23:35:04,687", "thread_id": "8716", "caller": "0x7ffbc7299058", "parentcaller": "0x7ffbc7209fcb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002da" }, { "name": "ValueName", "value": "LaunchPermission" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LaunchPermission" } ], "repeated": 0, "id": 562 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc720a010", "parentcaller": "0x7ffbc7224dd5", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE" }, { "name": "Handle", "value": "0x000002dc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE" } ], "repeated": 0, "id": 563 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc720a052", "parentcaller": "0x7ffbc7224dd5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002dc" }, { "name": "ValueName", "value": "LegacyAuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyAuthenticationLevel" } ], "repeated": 0, "id": 564 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc720a0a5", "parentcaller": "0x7ffbc7224dd5", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" }, { "name": "ValueName", "value": "LegacyImpersonationLevel" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyImpersonationLevel" } ], "repeated": 0, "id": 565 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc720a0de", "parentcaller": "0x7ffbc7224dd5", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 566 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc720a123", "parentcaller": "0x7ffbc7224dd5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002da" }, { "name": "ValueName", "value": "AuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AuthenticationLevel" } ], "repeated": 0, "id": 567 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002da" }, { "name": "ValueName", "value": "RemoteServerName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RemoteServerName" } ], "repeated": 0, "id": 568 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc720a1c8", "parentcaller": "0x7ffbc7224dd5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002da" }, { "name": "ValueName", "value": "SRPTrustLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\SRPTrustLevel" } ], "repeated": 0, "id": 569 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc720a227", "parentcaller": "0x7ffbc7224dd5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002da" }, { "name": "ValueName", "value": "PreferredServerBitness" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\PreferredServerBitness" } ], "repeated": 0, "id": 570 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc720a28a", "parentcaller": "0x7ffbc7224dd5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002da" }, { "name": "ValueName", "value": "LoadUserSettings" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LoadUserSettings" } ], "repeated": 0, "id": 571 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc720a318", "parentcaller": "0x7ffbc7224dd5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002da" }, { "name": "ValueName", "value": "ProtectionLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProtectionLevel" } ], "repeated": 0, "id": 572 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7224e2a", "parentcaller": "0x7ffbc720a9ba", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002da" } ], "repeated": 0, "id": 573 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc72a450c", "parentcaller": "0x7ffbc720aa90", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002d2" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000002da" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32" } ], "repeated": 0, "id": 574 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc72a4529", "parentcaller": "0x7ffbc720aa90", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002da" } ], "repeated": 0, "id": 575 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc544ddf0", "parentcaller": "0x7ffbc72a4a29", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 576 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc544de10", "parentcaller": "0x7ffbc72a4a29", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "1", "pretty_value": "FILE_OPEN" } ], "repeated": 0, "id": 577 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 578 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 579 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xc9\\xbf\\x0by\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00\\xd2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00y\\x00\\x00\\x00\\x80\\xca\\xbf\\x0by\\x00\\x00\\x00" } ], "repeated": 0, "id": 580 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalServer" } ], "repeated": 0, "id": 581 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 582 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d2" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalServer" } ], "repeated": 0, "id": 583 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc720ad16", "parentcaller": "0x7ffbc72083b8", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x000002da" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 584 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc720ad4d", "parentcaller": "0x7ffbc72083b8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002da" }, { "name": "SubKey", "value": "Elevation" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\Elevation" } ], "repeated": 0, "id": 585 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc720adb1", "parentcaller": "0x7ffbc72083b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002da" } ], "repeated": 0, "id": 586 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7208010", "parentcaller": "0x7ffbc72053d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d2" } ], "repeated": 0, "id": 587 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc72022bf", "parentcaller": "0x7ffbc72025e9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000252" }, { "name": "SubKey", "value": "CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x000002a2" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 588 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc727f8f8", "parentcaller": "0x7ffbc720213b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002a2" }, { "name": "SubKey", "value": "TreatAs" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" } ], "repeated": 0, "id": 589 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7202160", "parentcaller": "0x7ffbc71f9277", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a2" } ], "repeated": 0, "id": 590 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x7ffbc5c20000" } ], "repeated": 0, "id": 591 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7bb7cc6", "parentcaller": "0x7ffbc7b8ddf7", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 592 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7bb7cc6", "parentcaller": "0x7ffbc7b8ddf7", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\thumbcache" }, { "name": "DllBase", "value": "0x7ffbb0100000" } ], "repeated": 0, "id": 593 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\thumbcache.dll" }, { "name": "BaseAddress", "value": "0x7ffbb0100000" } ], "repeated": 0, "id": 594 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbb0100000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\thumbcache.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 595 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbc7226acf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "thumbcache.dll" }, { "name": "ModuleHandle", "value": "0x7ffbb0100000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbb011a900" } ], "repeated": 0, "id": 596 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbc7226ae8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "thumbcache.dll" }, { "name": "ModuleHandle", "value": "0x7ffbb0100000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbb012c5c0" } ], "repeated": 0, "id": 597 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbc7226b08", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "thumbcache.dll" }, { "name": "ModuleHandle", "value": "0x7ffbb0100000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbb011be50" } ], "repeated": 0, "id": 598 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7b97830", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbb0163000" }, { "name": "ModuleName", "value": "thumbcache.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 599 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7b97881", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbb0163000" }, { "name": "ModuleName", "value": "thumbcache.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 600 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbb0115294", "parentcaller": "0x7ffbc7265144", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 601 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc544e76a", "parentcaller": "0x7ffbc7210e64", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" } ], "repeated": 0, "id": 602 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbc7210e82", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" }, { "name": "FunctionName", "value": "CoGetMarshalSizeMax" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc723c590" } ], "repeated": 0, "id": 603 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbc7210e9f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" }, { "name": "FunctionName", "value": "CoMarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc724b0b0" } ], "repeated": 0, "id": 604 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbc7210ebc", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" }, { "name": "FunctionName", "value": "CoUnmarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7248b50" } ], "repeated": 0, "id": 605 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbc7210ed9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc71d0000" }, { "name": "FunctionName", "value": "CoReleaseMarshalData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc71fe790" } ], "repeated": 0, "id": 606 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc72022bf", "parentcaller": "0x7ffbc727fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000252" }, { "name": "SubKey", "value": "Interface\\{75121952-E0D0-43E5-9380-1D80483ACF72}" }, { "name": "Handle", "value": "0x000002e2" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{75121952-E0D0-43E5-9380-1D80483ACF72}" } ], "repeated": 0, "id": 607 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc727fa51", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e2" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x000002e6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{75121952-e0d0-43e5-9380-1d80483acf72}\\ProxyStubClsid32" } ], "repeated": 0, "id": 608 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc727fa8c", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{75121952-e0d0-43e5-9380-1d80483acf72}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 609 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc727fad3", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" } ], "repeated": 0, "id": 610 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc727fae4", "parentcaller": "0x7ffbc72442ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e2" } ], "repeated": 0, "id": 611 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7207b74", "parentcaller": "0x7ffbc72053d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "Handle", "value": "0x000002e2" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" } ], "repeated": 0, "id": 612 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 613 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 614 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xbb\\xbf\\x0by\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00\\xe2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00y\\x00\\x00\\x00\\xe0\\xbc\\xbf\\x0by\\x00\\x00\\x00" } ], "repeated": 0, "id": 615 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs" } ], "repeated": 0, "id": 616 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 617 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002e2" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs" } ], "repeated": 0, "id": 618 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc72922e1", "parentcaller": "0x7ffbc7207c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 619 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72081f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e2" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 620 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e2" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)" } ], "repeated": 0, "id": 621 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72087bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)" } ], "repeated": 0, "id": 622 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7208485", "parentcaller": "0x7ffbc720829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e2" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000002e6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocServer32" } ], "repeated": 0, "id": 623 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 624 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 625 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc5474aa9", "parentcaller": "0x7ffbc54531c6", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "%SystemRoot%\\system32\\propsys.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)" } ], "repeated": 1, "id": 626 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7208d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 627 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc720855f", "parentcaller": "0x7ffbc720829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" } ], "repeated": 0, "id": 628 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 629 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 630 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xba\\xbf\\x0by\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00\\xe2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00y\\x00\\x00\\x00p\\xbb\\xbf\\x0by\\x00\\x00\\x00" } ], "repeated": 0, "id": 631 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler32" } ], "repeated": 0, "id": 632 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 633 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002e2" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler32" } ], "repeated": 0, "id": 634 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 635 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 636 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xba\\xbf\\x0by\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00\\xe2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00y\\x00\\x00\\x00p\\xbb\\xbf\\x0by\\x00\\x00\\x00" } ], "repeated": 0, "id": 637 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler" } ], "repeated": 0, "id": 638 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 639 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002e2" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler" } ], "repeated": 0, "id": 640 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7208010", "parentcaller": "0x7ffbc72053d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e2" } ], "repeated": 0, "id": 641 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 642 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 643 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7207b74", "parentcaller": "0x7ffbc72053d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "Handle", "value": "0x000002e2" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" } ], "repeated": 0, "id": 644 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 645 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 646 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xb8\\xbf\\x0by\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00\\xe2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00y\\x00\\x00\\x00\\xa0\\xb9\\xbf\\x0by\\x00\\x00\\x00" } ], "repeated": 0, "id": 647 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs" } ], "repeated": 0, "id": 648 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 649 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002e2" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs" } ], "repeated": 0, "id": 650 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc72922e1", "parentcaller": "0x7ffbc7207c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 651 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72081f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e2" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 652 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e2" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)" } ], "repeated": 0, "id": 653 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72087bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)" } ], "repeated": 0, "id": 654 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7208485", "parentcaller": "0x7ffbc720829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e2" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000002e6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocServer32" } ], "repeated": 0, "id": 655 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 656 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 657 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc5474aa9", "parentcaller": "0x7ffbc54531c6", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "%SystemRoot%\\system32\\propsys.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)" } ], "repeated": 1, "id": 658 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7208d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 659 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc720855f", "parentcaller": "0x7ffbc720829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" } ], "repeated": 0, "id": 660 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 661 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 662 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xb7\\xbf\\x0by\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00\\xe2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00y\\x00\\x00\\x000\\xb8\\xbf\\x0by\\x00\\x00\\x00" } ], "repeated": 0, "id": 663 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler32" } ], "repeated": 0, "id": 664 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 665 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002e2" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler32" } ], "repeated": 0, "id": 666 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 667 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 668 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xb7\\xbf\\x0by\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00\\xe2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00y\\x00\\x00\\x000\\xb8\\xbf\\x0by\\x00\\x00\\x00" } ], "repeated": 0, "id": 669 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler" } ], "repeated": 0, "id": 670 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 671 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002e2" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler" } ], "repeated": 0, "id": 672 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc720ab08", "parentcaller": "0x7ffbc720a7d9", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002e2" }, { "name": "SubKey", "value": "LocalServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\LocalServer32" } ], "repeated": 0, "id": 673 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720a825", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e2" }, { "name": "ValueName", "value": "AppID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\AppID" } ], "repeated": 0, "id": 674 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 675 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 676 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xb6\\xbf\\x0by\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00\\xe2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00y\\x00\\x00\\x00p\\xb7\\xbf\\x0by\\x00\\x00\\x00" } ], "repeated": 0, "id": 677 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\LocalServer" } ], "repeated": 0, "id": 678 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 679 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002e2" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\LocalServer" } ], "repeated": 0, "id": 680 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc720ad16", "parentcaller": "0x7ffbc72083b8", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "Handle", "value": "0x000002e6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" } ], "repeated": 0, "id": 681 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc720ad4d", "parentcaller": "0x7ffbc72083b8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002e6" }, { "name": "SubKey", "value": "Elevation" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\Elevation" } ], "repeated": 0, "id": 682 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc720adb1", "parentcaller": "0x7ffbc72083b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" } ], "repeated": 0, "id": 683 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7208010", "parentcaller": "0x7ffbc72053d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e2" } ], "repeated": 0, "id": 684 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc72022bf", "parentcaller": "0x7ffbc72025e9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000252" }, { "name": "SubKey", "value": "CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "Handle", "value": "0x000002e2" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" } ], "repeated": 0, "id": 685 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc727f8f8", "parentcaller": "0x7ffbc720213b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002e2" }, { "name": "SubKey", "value": "TreatAs" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs" } ], "repeated": 0, "id": 686 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7202160", "parentcaller": "0x7ffbc71f9277", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e2" } ], "repeated": 0, "id": 687 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 688 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 689 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\propsys" }, { "name": "DllBase", "value": "0x7ffbc0db0000" } ], "repeated": 0, "id": 690 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\propsys.dll" }, { "name": "BaseAddress", "value": "0x7ffbc0db0000" } ], "repeated": 0, "id": 691 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc54556b2", "parentcaller": "0x7ffbc7226b6d", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ffbc0db0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\system32\\propsys.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 692 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbc7226acf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "propsys.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc0db0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc0dbb810" } ], "repeated": 0, "id": 693 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbc7226ae8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "propsys.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc0db0000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 694 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbc7226b08", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "propsys.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc0db0000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc0de6430" } ], "repeated": 0, "id": 695 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7b93f7a", "parentcaller": "0x7ffbc7020ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 696 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7020cd1", "parentcaller": "0x7ffbc701f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000002ec" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 697 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc549026b", "parentcaller": "0x7ffbc7020daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002f0" } ], "repeated": 0, "id": 698 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7b88cde", "parentcaller": "0x7ffbc7bc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x82\\x1a\\x0b\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xe2q\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 699 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7bb6e46", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xd8\\x9c\\xf7\\xab#\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 700 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7bb6e9b", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00\\x98\\xf7\\xab#\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 701 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7bb6ec0", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 702 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7bb6f0e", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x88\\xae\\xf7\\xab#\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 703 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7bb6f37", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 704 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7bb6f8f", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x18\\x99\\xf7\\xab#\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 705 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7bb7048", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00W>6\\xe7\\xf5\\xf5\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x000\\xca\\xbf\\x0by\\x00\\x00\\x00(\\xca\\xbf\\x0by\\x00\\x00\\x00\\xf8\\xc9\\xbf\\x0by\\x00\\x00\\x00\\x18\\xca\\xbf\\x0b" } ], "repeated": 0, "id": 706 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7bb707b", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x99\\xf7\\xab#\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x18\\xc8\\xbf\\x0by\\x00\\x00\\x00\\xf0\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 707 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7b88cde", "parentcaller": "0x7ffbc7b8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x82\\x1a\\x0b\\x00\\x00\\x00\\x00\\x00xq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xe2q\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 708 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7bb6e46", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "8\\x9a\\xf7\\xab#\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 709 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7bb6e9b", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xa0\\x9d\\xf7\\xab#\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 710 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7bb6ec0", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 711 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7bb6f0e", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "X\\xab\\xf7\\xab#\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 712 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7bb6f37", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 713 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7bb6f8f", "parentcaller": "0x7ffbc7b88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "X\\x9e\\xf7\\xab#\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcdn\\x02\\x00" } ], "repeated": 0, "id": 714 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7bb7048", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@l\\x86\\xfb\\x7f\\x00\\x00\\xebPD\\x86\\xfb\\x7f\\x00\\x00\\xf7A6\\xe7\\xf5\\xf5\\x00\\x00(Nh\\x86\\xfb\\x7f\\x00\\x00\\x90\\xc6\\xbf\\x0by\\x00\\x00\\x00\\x88\\xc6\\xbf\\x0by\\x00\\x00\\x00X\\xc6\\xbf\\x0by\\x00\\x00\\x00x\\xc6\\xbf\\x0b" } ], "repeated": 0, "id": 715 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc7bb707b", "parentcaller": "0x7ffbc7bb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x9e\\xf7\\xab#\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8E\\x86\\xfb\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xc4\\xbf\\x0by\\x00\\x00\\x00\\xf0\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xd7\\x87\\xfb\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2h\\x86" } ], "repeated": 0, "id": 716 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7020e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" } ], "repeated": 0, "id": 717 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8716", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7020e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f0" } ], "repeated": 0, "id": 718 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8708", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc7281dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 719 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "8708", "caller": "0x7ffbc7250e98", "parentcaller": "0x7ffbc72cb785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000304b8" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 720 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 721 }, { "timestamp": "2026-05-28 23:35:04,703", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 722 }, { "timestamp": "2026-05-28 23:35:04,718", "thread_id": "8708", "caller": "0x7ffbc54554eb", "parentcaller": "0x7ffbc722b0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 723 }, { "timestamp": "2026-05-28 23:35:04,718", "thread_id": "8708", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc728224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 724 }, { "timestamp": "2026-05-28 23:35:04,718", "thread_id": "8708", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 725 }, { "timestamp": "2026-05-28 23:35:04,718", "thread_id": "8708", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 726 }, { "timestamp": "2026-05-28 23:35:04,718", "thread_id": "8708", "caller": "0x7ffbc7250e98", "parentcaller": "0x7ffbc7252cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000304b8" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 727 }, { "timestamp": "2026-05-28 23:35:04,718", "thread_id": "8716", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc7281dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 728 }, { "timestamp": "2026-05-28 23:35:04,718", "thread_id": "8716", "caller": "0x7ffbb0115294", "parentcaller": "0x7ffbc7265144", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 729 }, { "timestamp": "2026-05-28 23:35:04,718", "thread_id": "8708", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc7281dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 730 }, { "timestamp": "2026-05-28 23:35:04,718", "thread_id": "8708", "caller": "0x7ffbc7250e98", "parentcaller": "0x7ffbc72cb785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000304b8" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 731 }, { "timestamp": "2026-05-28 23:35:04,718", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 732 }, { "timestamp": "2026-05-28 23:35:04,718", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 733 }, { "timestamp": "2026-05-28 23:35:04,718", "thread_id": "8708", "caller": "0x7ffbc54554eb", "parentcaller": "0x7ffbc722b0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 734 }, { "timestamp": "2026-05-28 23:35:04,718", "thread_id": "8708", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc728224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 735 }, { "timestamp": "2026-05-28 23:35:04,718", "thread_id": "8708", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 736 }, { "timestamp": "2026-05-28 23:35:04,718", "thread_id": "8708", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 737 }, { "timestamp": "2026-05-28 23:35:04,718", "thread_id": "8708", "caller": "0x7ffbc7250e98", "parentcaller": "0x7ffbc7252cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000304b8" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 738 }, { "timestamp": "2026-05-28 23:35:04,718", "thread_id": "8716", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc7281dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 739 }, { "timestamp": "2026-05-28 23:35:04,718", "thread_id": "8716", "caller": "0x7ffbb0115294", "parentcaller": "0x7ffbc7265144", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 740 }, { "timestamp": "2026-05-28 23:35:04,718", "thread_id": "8708", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc7281dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 741 }, { "timestamp": "2026-05-28 23:35:04,718", "thread_id": "8708", "caller": "0x7ffbc7250e98", "parentcaller": "0x7ffbc72cb785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000304b8" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 742 }, { "timestamp": "2026-05-28 23:35:04,718", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 743 }, { "timestamp": "2026-05-28 23:35:04,718", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 744 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8708", "caller": "0x7ffbc54554eb", "parentcaller": "0x7ffbc722b0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 745 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8708", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc728224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 746 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8708", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 747 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8708", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 748 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8708", "caller": "0x7ffbc7250e98", "parentcaller": "0x7ffbc7252cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000304b8" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 749 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8716", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc7281dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 750 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8716", "caller": "0x7ffbb0115294", "parentcaller": "0x7ffbc7265144", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 751 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8708", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc7281dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 752 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8708", "caller": "0x7ffbc7250e98", "parentcaller": "0x7ffbc72cb785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000304b8" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 753 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 754 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 755 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8708", "caller": "0x7ffbc54554eb", "parentcaller": "0x7ffbc722b0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 756 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8708", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc728224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 757 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8708", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 758 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8708", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 759 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8708", "caller": "0x7ffbc7250e98", "parentcaller": "0x7ffbc7252cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000304b8" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 760 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8716", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc7281dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 761 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8716", "caller": "0x7ffbb0115294", "parentcaller": "0x7ffbc7265144", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 762 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8708", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc7281dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 763 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8708", "caller": "0x7ffbc7250e98", "parentcaller": "0x7ffbc72cb785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000304b8" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 764 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 765 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 766 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8708", "caller": "0x7ffbc54554eb", "parentcaller": "0x7ffbc722b0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 767 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8708", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc728224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 768 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8708", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 769 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8708", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 770 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8708", "caller": "0x7ffbc7250e98", "parentcaller": "0x7ffbc7252cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000304b8" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 771 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8716", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc7281dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 772 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8716", "caller": "0x7ffbb0115294", "parentcaller": "0x7ffbc7265144", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 773 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8708", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc7281dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 774 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8708", "caller": "0x7ffbc7250e98", "parentcaller": "0x7ffbc72cb785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000304b8" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 775 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 776 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 777 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8708", "caller": "0x7ffbc54554eb", "parentcaller": "0x7ffbc722b0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 778 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8708", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc728224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 779 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8708", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 780 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8708", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 781 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8708", "caller": "0x7ffbc7250e98", "parentcaller": "0x7ffbc7252cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000304b8" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 782 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8716", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc7281dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 783 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8716", "caller": "0x7ffbb0115294", "parentcaller": "0x7ffbc7265144", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 784 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8708", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc7281dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 785 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "8708", "caller": "0x7ffbc7250e98", "parentcaller": "0x7ffbc72cb785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000304b8" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 786 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 787 }, { "timestamp": "2026-05-28 23:35:04,734", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 788 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc54554eb", "parentcaller": "0x7ffbc722b0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 789 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc728224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 790 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc7207b74", "parentcaller": "0x7ffbc72053d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x000002fa" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 791 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fa" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 792 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fa" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 793 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xca\\x9f\\x0by\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00\\xfa\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00y\\x00\\x00\\x00\\x90\\xcb\\x9f\\x0by\\x00\\x00\\x00" } ], "repeated": 0, "id": 794 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" } ], "repeated": 0, "id": 795 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fa" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 796 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002fa" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" } ], "repeated": 0, "id": 797 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc72922e1", "parentcaller": "0x7ffbc7207c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fa" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 798 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72081f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002fa" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 799 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fa" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 800 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72087bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fa" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Thumbnail Cache Class Factory for Out of Proc Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 801 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc7208485", "parentcaller": "0x7ffbc720829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002fa" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000002d2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32" } ], "repeated": 0, "id": 802 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002d2" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\InprocServer32" } ], "repeated": 0, "id": 803 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d2" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 804 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72087bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\thumbcache.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 805 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7208d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d2" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Apartment" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\ThreadingModel" } ], "repeated": 0, "id": 806 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc720855f", "parentcaller": "0x7ffbc720829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d2" } ], "repeated": 0, "id": 807 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fa" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 808 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fa" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 809 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xc9\\x9f\\x0by\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00\\xfa\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00y\\x00\\x00\\x00 \\xca\\x9f\\x0by\\x00\\x00\\x00" } ], "repeated": 0, "id": 810 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" } ], "repeated": 0, "id": 811 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fa" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 812 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002fa" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" } ], "repeated": 0, "id": 813 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fa" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 814 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fa" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 815 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xc9\\x9f\\x0by\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00\\xfa\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00y\\x00\\x00\\x00 \\xca\\x9f\\x0by\\x00\\x00\\x00" } ], "repeated": 0, "id": 816 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" } ], "repeated": 0, "id": 817 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fa" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 818 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002fa" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" } ], "repeated": 0, "id": 819 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc7208010", "parentcaller": "0x7ffbc72053d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fa" } ], "repeated": 0, "id": 820 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc7250e98", "parentcaller": "0x7ffbc7252cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000304b8" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 821 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8716", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc7281dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 822 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8716", "caller": "0x7ffbb0115294", "parentcaller": "0x7ffbc7265144", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 823 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc7281dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 824 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc7250e98", "parentcaller": "0x7ffbc72cb785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000304b8" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 825 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 826 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 827 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc54554eb", "parentcaller": "0x7ffbc722b0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 828 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc728224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 829 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc7207b74", "parentcaller": "0x7ffbc72053d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000232" }, { "name": "SubKey", "value": "CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x000002fe" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 830 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fe" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 831 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fe" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 832 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xca\\x9f\\x0by\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00\\xfe\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00y\\x00\\x00\\x00\\x90\\xcb\\x9f\\x0by\\x00\\x00\\x00" } ], "repeated": 0, "id": 833 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" } ], "repeated": 0, "id": 834 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fe" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 835 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002fe" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" } ], "repeated": 0, "id": 836 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc72922e1", "parentcaller": "0x7ffbc7207c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fe" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 837 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72081f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002fe" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 838 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fe" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 839 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72087bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fe" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Thumbnail Cache Class Factory for Out of Proc Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 840 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc7208485", "parentcaller": "0x7ffbc720829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002fe" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00000302" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32" } ], "repeated": 0, "id": 841 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000302" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\InprocServer32" } ], "repeated": 0, "id": 842 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc720870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000302" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 843 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc72087bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000302" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\thumbcache.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 844 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc5452e92", "parentcaller": "0x7ffbc7208d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000302" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Apartment" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\ThreadingModel" } ], "repeated": 0, "id": 845 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc720855f", "parentcaller": "0x7ffbc720829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000302" } ], "repeated": 0, "id": 846 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fe" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 847 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fe" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 848 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xc9\\x9f\\x0by\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00\\xfe\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00y\\x00\\x00\\x00 \\xca\\x9f\\x0by\\x00\\x00\\x00" } ], "repeated": 0, "id": 849 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" } ], "repeated": 0, "id": 850 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fe" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 851 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002fe" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" } ], "repeated": 0, "id": 852 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc54545a7", "parentcaller": "0x7ffbc5450705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fe" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 853 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc5452314", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fe" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 854 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc7b86c8b", "parentcaller": "0x7ffbc54523a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xc9\\x9f\\x0by\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xfb\\x7f\\x00\\x00\\xb8\\xcfh\\x86\\xfb\\x7f\\x00\\x00\\xfe\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2h\\x86\\xfb\\x7f\\x00\\x00\\x04\\x00\\x00\\x00y\\x00\\x00\\x00 \\xca\\x9f\\x0by\\x00\\x00\\x00" } ], "repeated": 0, "id": 855 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc54524a8", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" } ], "repeated": 0, "id": 856 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc54540c4", "parentcaller": "0x7ffbc54525c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fe" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 857 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc54525e2", "parentcaller": "0x7ffbc5450732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002fe" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" } ], "repeated": 0, "id": 858 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc7208010", "parentcaller": "0x7ffbc72053d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fe" } ], "repeated": 0, "id": 859 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc7250e98", "parentcaller": "0x7ffbc7252cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000304b8" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 860 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8716", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc7281dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 861 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8716", "caller": "0x7ffbb0115294", "parentcaller": "0x7ffbc7265144", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 862 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc7281dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 863 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "8708", "caller": "0x7ffbc7250e98", "parentcaller": "0x7ffbc72cb785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000304b8" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 864 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 865 }, { "timestamp": "2026-05-28 23:35:07,359", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 866 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223abf86000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 867 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc54554eb", "parentcaller": "0x7ffbc722b0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 868 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc728224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 869 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 870 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 871 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc7250e98", "parentcaller": "0x7ffbc7252cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000304b8" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 872 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8716", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc7281dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 873 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8716", "caller": "0x7ffbb0115294", "parentcaller": "0x7ffbc7265144", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 874 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc7281dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 875 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc7b5e715", "parentcaller": "0x7ffbc7b5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223abf8b000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 876 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc7250e98", "parentcaller": "0x7ffbc72cb785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000304b8" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 877 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 878 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 879 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc54554eb", "parentcaller": "0x7ffbc722b0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 880 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc728224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 881 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 882 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 883 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc7250e98", "parentcaller": "0x7ffbc7252cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000304b8" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 884 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8716", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc7281dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 885 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8716", "caller": "0x7ffbb0115294", "parentcaller": "0x7ffbc7265144", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 886 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc7281dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 887 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc7250e98", "parentcaller": "0x7ffbc72cb785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000304b8" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 888 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 889 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 890 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc54554eb", "parentcaller": "0x7ffbc722b0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 891 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc728224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 892 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 893 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 894 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc7250e98", "parentcaller": "0x7ffbc7252cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000304b8" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 895 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8716", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc7281dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 896 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8716", "caller": "0x7ffbb0115294", "parentcaller": "0x7ffbc7265144", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 897 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc7281dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 898 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc7250e98", "parentcaller": "0x7ffbc72cb785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000304b8" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 899 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 900 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 901 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc54554eb", "parentcaller": "0x7ffbc722b0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 902 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc728224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 903 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 904 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 905 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc7250e98", "parentcaller": "0x7ffbc7252cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000304b8" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 906 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8716", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc7281dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 907 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8716", "caller": "0x7ffbb0115294", "parentcaller": "0x7ffbc7265144", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 908 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc7281dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 909 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc7250e98", "parentcaller": "0x7ffbc72cb785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000304b8" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 910 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 911 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 912 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc54554eb", "parentcaller": "0x7ffbc722b0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 913 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc728224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 914 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 915 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 916 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc7250e98", "parentcaller": "0x7ffbc7252cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000304b8" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 917 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8716", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc7281dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 918 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8716", "caller": "0x7ffbb0115294", "parentcaller": "0x7ffbc7265144", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 919 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc7281dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 920 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc7250e98", "parentcaller": "0x7ffbc72cb785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000304b8" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 921 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 922 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 923 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc54554eb", "parentcaller": "0x7ffbc722b0ca", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 924 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc728224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 925 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 926 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc54430ce", "parentcaller": "0x7ffbc7282cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 927 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8708", "caller": "0x7ffbc7250e98", "parentcaller": "0x7ffbc7252cd6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000304b8" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 928 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8716", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc7281dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 929 }, { "timestamp": "2026-05-28 23:35:07,375", "thread_id": "8716", "caller": "0x7ffbb0115294", "parentcaller": "0x7ffbc7265144", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 930 }, { "timestamp": "2026-05-28 23:35:07,390", "thread_id": "8708", "caller": "0x7ffbc72492b9", "parentcaller": "0x7ffbc7281dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 931 }, { "timestamp": "2026-05-28 23:35:07,390", "thread_id": "8708", "caller": "0x7ffbc7250e98", "parentcaller": "0x7ffbc72cb785", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000304b8" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 932 }, { "timestamp": "2026-05-28 23:35:07,390", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 933 }, { "timestamp": "2026-05-28 23:35:07,390", "thread_id": "9004", "caller": "0x7ff69bcf116a", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 934 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "9004", "caller": "0x7ff69bcf1176", "parentcaller": "0x7ff69bcf1466", "category": "windows", "api": "PostThreadMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessId", "value": "8996" }, { "name": "ThreadId", "value": "8716" }, { "name": "Message", "value": "1033" } ], "repeated": 0, "id": 935 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "9004", "caller": "0x7ff69bcf1176", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000270" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 936 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "8716", "caller": "0x7ffbc7ba0444", "parentcaller": "0x7ffbb012c60f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 937 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "8716", "caller": "0x7ffbc544e76a", "parentcaller": "0x7ffbb0119248", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" } ], "repeated": 0, "id": 938 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "8716", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbb011774b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bb3410" } ], "repeated": 0, "id": 939 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "8716", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbb011774b", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\thumbcache" }, { "name": "DllBase", "value": "0x7ffbb0100000" } ], "repeated": 0, "id": 940 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "8716", "caller": "0x7ffbc7ba0444", "parentcaller": "0x7ffbc5c54def", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a0" } ], "repeated": 0, "id": 941 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "8716", "caller": "0x7ffbc544e76a", "parentcaller": "0x7ffbc5c3c408", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" } ], "repeated": 0, "id": 942 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "8716", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbc5c3c3cb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc7b50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ffbc7bb3410" } ], "repeated": 0, "id": 943 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "8716", "caller": "0x7ffbc545ac31", "parentcaller": "0x7ffbc5c3c3cb", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x7ffbc5c20000" } ], "repeated": 0, "id": 944 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "8716", "caller": "0x7ffbc7bc0db0", "parentcaller": "0x7ffbc7b80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc5c20000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 945 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "8716", "caller": "0x7ffbc7bc0db0", "parentcaller": "0x7ffbc7b80391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbb0100000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 946 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "8716", "caller": "0x7ffbc544e76a", "parentcaller": "0x7ffbc71fea0e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc6e60000" } ], "repeated": 0, "id": 947 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "8716", "caller": "0x7ffbc7b97830", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 948 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "8716", "caller": "0x7ffbc7b97881", "parentcaller": "0x7ffbc7b820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ffbc7501000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 949 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "9004", "caller": "0x7ff69bcf1176", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000270" } ], "repeated": 0, "id": 950 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "9004", "caller": "0x7ff69bcf1176", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" } ], "repeated": 0, "id": 951 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "9004", "caller": "0x7ff69bcf1176", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f8" } ], "repeated": 0, "id": 952 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "9004", "caller": "0x7ff69bcf1176", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 953 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "9004", "caller": "0x7ff69bcf1176", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" } ], "repeated": 0, "id": 954 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "9004", "caller": "0x7ff69bcf1176", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000264" } ], "repeated": 0, "id": 955 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "9004", "caller": "0x7ff69bcf1176", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtDelayExecution", "status": true, "return": "0x00000000", "arguments": [ { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 956 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "8716", "caller": "0x7ffbc71fcd6e", "parentcaller": "0x7ffbc7272ed4", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 957 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "8716", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc7274324", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000288" } ], "repeated": 0, "id": 958 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "8716", "caller": "0x7ffbc7ba467e", "parentcaller": "0x7ffbc549f79a", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "8716" } ], "repeated": 0, "id": 959 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "9004", "caller": "0x7ff69bcf1176", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 960 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "9004", "caller": "0x7ff69bcf1176", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223abf57000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 961 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "9004", "caller": "0x7ff69bcf1176", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223abf85000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 962 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "8708", "caller": "0x7ffbc705bf07", "parentcaller": "0x7ffbc705be66", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 963 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "8716", "caller": "0x7ffbc75315b8", "parentcaller": "0x7ffbc7b69a1d", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 964 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "9004", "caller": "0x7ff69bcf1176", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223abf62000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 965 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "8708", "caller": "0x7ffbc7015bc1", "parentcaller": "0x7ffbc7015b34", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 966 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "8716", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc706e41e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 967 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "8716", "caller": "0x7ffbc5456785", "parentcaller": "0x7ffbc706e4e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 968 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "9004", "caller": "0x7ff69bcf1176", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x223ad9e0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 969 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "9004", "caller": "0x7ff69bcf1176", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 970 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "8716", "caller": "0x7ffbc7ba469e", "parentcaller": "0x7ffbc549f79a", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 971 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "9004", "caller": "0x7ff69bcf1176", "parentcaller": "0x7ff69bcf1466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000232" } ], "repeated": 0, "id": 972 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "9004", "caller": "0x7ff69bcf1176", "parentcaller": "0x7ff69bcf1466", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7ffbc6e60000" } ], "repeated": 0, "id": 973 }, { "timestamp": "2026-05-28 23:35:12,406", "thread_id": "9004", "caller": "0x7ff69bcf1193", "parentcaller": "0x7ff69bcf1466", "category": "process", "api": "NtTerminateProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "ExitCode", "value": "0x00000000" } ], "repeated": 0, "id": 974 } ], "threads": [ "9004", "9260", "9252", "9248", "9000", "8664", "8708", "8700", "8716", "8712" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff69bcf0000", "MainExeSize": "0x00009000", "Bitness": "64-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } } ], "anomaly": [], "processtree": [ { "name": "explorer.exe", "pid": 4692, "parent_id": 4636, "module_path": "C:\\Windows\\explorer.exe", "children": [ { "name": "msedge.exe", "pid": 5704, "parent_id": 4692, "module_path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", "children": [ { "name": "identity_helper.exe", "pid": 9452, "parent_id": 5704, "module_path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe", "children": [], "threads": [ "9456", "9624", "9628", "9616", "9620", "9776", "9784", "9792", "9796", "9800", "9804", "9808", "9812", "9840", "9868", "9872", "9876", "9880", "9592", "10100", "10132" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5816,i,7984218614831481947,5522388298470254199,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5860 /prefetch:8", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff64b540000", "MainExeSize": "0x0028c000", "Bitness": "64-bit" } } ], "threads": [ "3916", "3080", "8224", "8280", "8264", "8304", "8348", "8364", "8232", "8464", "8216", "8432", "8428", "8268", "9080", "8324", "9156", "8236", "8436", "8360", "8852", "8228", "6212", "8796", "8272", "8952", "8212", "9016" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" \"https://badoomovies.com/download/BadooMovies.exe\"", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff66c3b0000", "MainExeSize": "0x00505000", "Bitness": "64-bit" } } ], "threads": [ "4696", "5044", "7540", "4824", "5824", "4864", "4828", "5836", "4944", "5244", "5140", "5816", "5144", "3700", "4644", "6052", "4832", "4732", "4188", "5008", "4744", "4788", "5856", "5832", "2404", "5852", "5260", "4748", "3100", "4868", "5020", "8988", "8944", "5860", "8884", "9036", "8888", "8728", "8784", "4708", "10056", "9172", "5068", "8564", "2956" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "C:\\Windows\\Explorer.EXE", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff627610000", "MainExeSize": "0x00546000", "Bitness": "64-bit" } }, { "name": "svchost.exe", "pid": 844, "parent_id": 632, "module_path": "C:\\Windows\\System32\\svchost.exe", "children": [ { "name": "dllhost.exe", "pid": 8996, "parent_id": 844, "module_path": "C:\\Windows\\System32\\dllhost.exe", "children": [], "threads": [ "9004", "9260", "9252", "9248", "9000", "8664", "8708", "8700", "8716", "8712" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff69bcf0000", "MainExeSize": "0x00009000", "Bitness": "64-bit" } } ], "threads": [ "1144", "420", "1108", "1000", "1088", "4372", "2244", "944", "940" ], "environ": { "UserName": "SYSTEM", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Windows\\TEMP\\", "CommandLine": "C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff6a8e20000", "MainExeSize": "0x00010000", "Bitness": "64-bit" } } ], "summary": { "files": [ "\\Device\\Bam", "C:\\", "C:\\Users\\desktop.ini", "C:\\Users", "C:\\Users\\admin", "C:\\Users\\admin\\AppData", "C:\\Users\\admin\\AppData\\Roaming", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\desktop.ini", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs", "C:\\ProgramData\\Microsoft\\Windows\\Start Menu", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Burn", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", "C:\\Users\\Public\\Desktop", "C:\\Users\\admin\\Desktop", "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep", "C:\\Windows\\apppatch\\sysmain.sdb", "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep", "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.StartMenuExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep", "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep", "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecHealthUI_10.0.19041.3636_neutral__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep", "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\windows.immersivecontrolpanel_10.0.2.1000_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep", "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep", "C:\\Windows\\", "C:\\Windows\\System32\\", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", "C:\\Windows", "C:\\Windows\\System32\\WindowsPowerShell\\", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", "C:\\Windows\\System32\\windowspowershell\\v1.0\\powershell.exe", "C:\\Windows\\System32\\windowspowershell\\SystemResources\\powershell.exe.mun", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer", "C:\\Program Files (x86)\\Microsoft\\", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\", "C:\\program files (x86)\\microsoft\\Edge\\application\\msedge.exe", "C:\\program files (x86)\\microsoft\\Edge\\SystemResources\\msedge.exe.mun", "C:\\Windows\\System32\\twinui.pcshell.dll", "C:\\Windows\\System32\\SecurityHealthSSO.dll", "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-LIGHT.svg", "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-DARK.svg", "C:\\Windows\\explorer.exe", "C:\\Windows\\System32\\d3d10warp.dll", "C:\\Windows\\SystemApps\\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\\resources.pri", "C:\\Windows\\SystemApps\\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\\pris\\", "C:\\Windows\\SystemApps\\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\\", "C:\\Windows\\rescache\\_merged\\92721896\\3889361505.pri", "C:\\Windows\\SystemApps\\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\\pris\\resources.en-US.pri", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk", "C:\\Windows\\System32\\ieframe.dll", "C:\\Windows\\System32\\UIRibbonRes.dll", "C:\\Windows\\System32\\en-US\\UIRibbon.dll.mui", "C:\\Windows\\SystemResources\\UIRibbon.dll.mun", "C:\\Windows\\System32\\en-US\\UIAutomationCore.DLL.mui", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms", "C:\\Windows\\resources\\Themes\\aero\\Shell\\NormalColor\\ShellStyle.dll", "C:\\Windows\\System32\\imageres.dll", "C:\\Windows\\SystemResources\\imageres.dll.mun", "C:\\Users\\admin\\Desktop\\desktop.ini", "C:\\Users\\admin\\Downloads\\desktop.ini", "C:\\Users\\admin\\Documents\\desktop.ini", "C:\\Users\\admin\\Pictures\\desktop.ini", "C:\\Users\\admin\\Music\\desktop.ini", "C:\\Users\\admin\\Videos\\desktop.ini", "C:\\Users\\Public\\Desktop\\desktop.ini", "::\\", "C:\\Users\\admin\\OneDrive\\desktop.ini", "\\??\\STORAGE#Volume#{e32a9442-5af2-11f1-ae2c-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}", "\\??\\MountPointManager", "\\??\\STORAGE#Volume#{e32a9442-5af2-11f1-ae2c-806e6f6e6963}#0000000003300000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}", "C:\\Users\\admin\\OneDrive", "C:\\Users\\admin\\OneDrive\\", "C:\\Users\\admin\\", "C:\\Users\\", "C:", "C:\\Users\\admin\\Downloads", "C:\\Users\\admin\\Documents", "C:\\Users\\admin\\Pictures", "C:\\Users\\admin\\Music", "C:\\Users\\admin\\Videos", "C:\\Users\\admin\\AppData\\Local", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db", "C:\\Users\\admin\\Documents\\", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db", "C:\\Windows\\System32\\mpr.dll", "C:\\Windows\\System32\\en-US\\MPR.dll.mui", "\\??\\PIPE\\wkssvc", "\\Device\\DfsClient", "\\??\\PIPE\\DAV RPC SERVICE", "C:\\Users\\admin\\3D Objects\\desktop.ini", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db", "C:\\Windows\\System32\\en-US\\imageres.dll.mui", "C:\\Windows\\System32\\SystemResources\\imageres.dll.mui.mun", "\\Device\\DeviceApi\\Dev\\Query", "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\desktop.ini", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db", "C:\\Users\\admin\\Downloads\\", "C:\\Users\\admin\\Downloads\\BadooMovies.exe", "C:\\Users\\admin\\Downloads\\BadooMovies.exe.Config", "C:\\Users\\admin\\SystemResources\\BadooMovies.exe.mun", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_16.db", "C:\\$Recycle.Bin\\S-1-5-21-3968686040-3210279463-847977608-1001", "C:\\$Recycle.Bin\\S-1-5-21-3968686040-3210279463-847977608-1001\\desktop.ini", "C:\\Users\\admin\\Downloads\\BadooMovies.exe:Zone.Identifier", "C:\\Users\\admin\\Downloads\\BadooMovies.exe\\", "\\??\\Volume{528c102f-0000-0000-0000-300300000000}", "C:\\Windows\\System32\\UIAutomationCore.dll\\5", "C:\\Windows\\System32\\UIAutomationCore.dll", "C:\\Windows\\System32\\stdole2.tlb", "C:\\Windows\\System32\\usp10.dll", "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls", "\\??\\pipe\\crashpad_5704_NNHQBWYIOOVGEUEH", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\148.0.3967.83\\msedge.dll", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge.dll", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\icudtl.dat", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\v8_context_snapshot.bin", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_100_percent.pak", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_200_percent.pak", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\Locales", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\Locales\\en-US.pak", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\resources.pak", "C:\\Windows\\System32\\policymanager.dll", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msvcp110_win.dll", "C:\\Windows\\System32\\msvcp110_win.dll", "C:\\Windows\\System32\\usermgrcli.dll", "C:\\Windows\\System32\\capauthz.dll", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\MSASN1.dll", "C:\\Windows\\System32\\msasn1.dll", "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep", "C:\\Windows\\System32\\en-US\\KERNELBASE.dll.mui", "C:\\Windows\\SysWOW64\\propsys.dll", "C:\\Windows\\System32\\propsys.dll", "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe", "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\", "C:\\Users\\admin\\AppData\\Local\\Packages", "C:\\Users\\admin\\AppData\\Local\\Packages\\", "C:\\Users\\admin\\AppData\\Local\\", "C:\\Users\\admin\\AppData\\", "\\Device\\DeviceApi\\CMApi", "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\LocalState\\ToastCollectionIcons\\*", "\\??\\PhysicalDrive0", "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\\S-1-5-18.pckgdep", "C:\\Windows\\System32\\kernel.appcore.dll", "\\Device\\CNG" ], "read_files": [], "write_files": [ "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db", "\\??\\PIPE\\wkssvc", "\\??\\PIPE\\DAV RPC SERVICE", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db", "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_16.db", "\\??\\pipe\\crashpad_5704_NNHQBWYIOOVGEUEH" ], "delete_files": [], "keys": [ "HKEY_LOCAL_MACHINE\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\channel", "HKEY_LOCAL_MACHINE\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ap", "HKEY_LOCAL_MACHINE\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\name", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-AU", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-AU", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-AU", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\OEM\\DeviceForm", "HKEY_CURRENT_USER", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\UBR", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\\LocalServer32", "HKEY_CURRENT_USER\\Software\\Classes", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\COM3", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsRuntime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\Diagnosis", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel", "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\identity_helper.exe", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\DefaultAccessPermission", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{E1CDD77A-65D3-4DB0-B339-21F6A48CC2FF}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E1CDD77A-65D3-4db0-B339-21F6A48CC2FF}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E1CDD77A-65D3-4db0-B339-21F6A48CC2FF}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{00000035-0000-0000-C000-000000000046}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000035-0000-0000-C000-000000000046}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000035-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{428D4DDD-3462-43DF-9395-1EFF13AE7A4B}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{428D4DDD-3462-43DF-9395-1EFF13AE7A4B}\\ProxyStubClsid32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{B03C2205-F02E-4D77-80DF-E1747AFDD39C}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{50AC103F-D235-4598-BBEF-98FE4D1A3AD4}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{50ac103f-d235-4598-bbef-98fe4d1a3ad4}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\ThreadingModel", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\TreatAs", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\ActivateOnHostFlags", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\LocalServer32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\Elevation", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{B03C2205-F02E-4D77-80DF-E1747AFDD39C}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\AppID", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\Elevation", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7AB93C52-0E48-4750-BA9D-1A4113981847}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7ab93c52-0e48-4750-ba9d-1a4113981847}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7ab93c52-0e48-4750-ba9d-1a4113981847}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5CADDC63-01D3-4C97-986F-0533483FEE14}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5caddc63-01d3-4c97-986f-0533483fee14}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5caddc63-01d3-4c97-986f-0533483fee14}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bc3d253-2f31-4092-9129-8ad5abf067da}\\ProxyStubClsid32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0C9281F9-6DA1-4006-8729-DE6E6B61581C}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocServer32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers\\WaitForRestore", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\ActivateOnHostFlags", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\PolicyType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Behavior", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirectMapped", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyname", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyismultisz", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicymultiszSeparatorChar", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataDevice", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataBoth", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\30Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\AppID", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\PolicyType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\MergeAlgorithm", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirectMapped", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirect", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyismultisz", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicymultiszSeparatorChar", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataDevice", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataBoth", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\30Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Value", "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\PolicyType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Behavior", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\MergeAlgorithm", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirectMapped", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirect", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicypath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyismultisz", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicymultiszSeparatorChar", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataDevice", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataBoth", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\30Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Value", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\PolicyType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Behavior", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\MergeAlgorithm", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirectMapped", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirect", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyismultisz", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicymultiszSeparatorChar", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataDevice", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataBoth", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\30Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CustomAttributes", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{84103CCB-2FD7-4D6C-962E-5D8582B4C720}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{84103ccb-2fd7-4d6c-962e-5d8582b4c720}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{84103ccb-2fd7-4d6c-962e-5d8582b4c720}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{A819F3DE-60AA-5159-8407-F0A7FB1F6832}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{a819f3de-60aa-5159-8407-f0a7fb1f6832}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\Elevation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{a819f3de-60aa-5159-8407-f0a7fb1f6832}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5232F8EA-49C7-4840-BFBB-66E785689E88}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5232f8ea-49c7-4840-bfbb-66e785689e88}\\ProxyStubClsid32", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{79AB57F6-43FE-487B-8A7F-99567200AE94}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5232f8ea-49c7-4840-bfbb-66e785689e88}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{79ab57f6-43fe-487b-8a7f-99567200ae94}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateOnHostFlags", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{679C64B7-81AB-42C2-8819-C958767753F4}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{679C64B7-81AB-42C2-8819-C958767753F4}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{679C64B7-81AB-42C2-8819-C958767753F4}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{0450CE77-AF0D-40AC-93FD-1E5D48C89419}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0450ce77-af0d-40ac-93fd-1e5d48c89419}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0450ce77-af0d-40ac-93fd-1e5d48c89419}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{195F5943-0C04-4EAB-B907-735817FDAC77}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{195f5943-0c04-4eab-b907-735817fdac77}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{195f5943-0c04-4eab-b907-735817fdac77}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{F655B052-348B-4AB0-947B-A7DAFA44D404}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{F655B052-348B-4AB0-947B-A7DAFA44D404}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{F655B052-348B-4AB0-947B-A7DAFA44D404}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\msasn1", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\HasRepaired", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\HasRepaired\\VolatileChildTest", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapDBRedirect", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\MergeAlgorithm", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirect", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Behavior", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{2A1821FE-179D-49BC-B79D-A527920D3665}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2A1821FE-179D-49BC-B79D-A527920D3665}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2A1821FE-179D-49BC-B79D-A527920D3665}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Appx", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Server", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{C5543B33-5C73-4DC5-9211-24077D3B06C5}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C5543B33-5C73-4DC5-9211-24077D3B06C5}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C5543B33-5C73-4DC5-9211-24077D3B06C5}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\Expiration", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\XAML", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\XAML\\OneCoreTransformsEnabledByDefault", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\IdentityType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExplicitPsmActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\CustomAttributes", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{350E1244-4575-45EE-8595-0AA8C6506FC7}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{350E1244-4575-45EE-8595-0AA8C6506FC7}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{350E1244-4575-45EE-8595-0AA8C6506FC7}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{01CF8BD4-E3D6-413D-8339-36D46E78D12C}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\AppID", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\Elevation", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{100EB64B-B24C-4C38-8964-720D926D05A4}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{100EB64B-B24C-4C38-8964-720D926D05A4}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{100EB64B-B24C-4C38-8964-720D926D05A4}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{100EB64B-B24C-4C38-8964-720D926D05A4}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateOnHostFlags", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{B3F72108-5C5C-469B-A5E5-3F64D2A39B01}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{b3f72108-5c5c-469b-a5e5-3f64d2a39b01}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{b3f72108-5c5c-469b-a5e5-3f64d2a39b01}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateOnHostFlags", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{D81E96F1-A89C-417E-9335-59531026309D}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{d81e96f1-a89c-417e-9335-59531026309d}\\ProxyStubClsid32", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{d81e96f1-a89c-417e-9335-59531026309d}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{d81e96f1-a89c-417e-9335-59531026309d}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{3BED20A5-6DEE-4297-B976-3B30DF69A7AA}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bed20a5-6dee-4297-b976-3b30df69a7aa}\\ProxyStubClsid32", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{3bed20a5-6dee-4297-b976-3b30df69a7aa}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bed20a5-6dee-4297-b976-3b30df69a7aa}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7F290DA0-75E3-5885-898D-1F5B1ED47ED2}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7f290da0-75e3-5885-898d-1f5b1ed47ed2}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7f290da0-75e3-5885-898d-1f5b1ed47ed2}\\ProxyStubClsid32", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{9ED07B24-36FD-543B-948E-B01FE5814B49}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9ed07b24-36fd-543b-948e-b01fe5814b49}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9ed07b24-36fd-543b-948e-b01fe5814b49}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{EFE869FC-5841-55F1-AA56-82C7219AAA09}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{efe869fc-5841-55f1-aa56-82c7219aaa09}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{efe869fc-5841-55f1-aa56-82c7219aaa09}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateOnHostFlags", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\ThreadingModel", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\AppID", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\Elevation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateOnHostFlags", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{E44EA1DF-BB85-5A8C-BDDC-C8E960C355C9}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{e44ea1df-bb85-5a8c-bddc-c8e960c355c9}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{e44ea1df-bb85-5a8c-bddc-c8e960c355c9}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8CBD762A-1222-5EE5-B745-489E7A42C6EC}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8cbd762a-1222-5ee5-b745-489e7a42c6ec}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8cbd762a-1222-5ee5-b745-489e7a42c6ec}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateOnHostFlags", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{6D3BC882-23A4-4706-B8FA-FC7DE2FC325D}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{6d3bc882-23a4-4706-b8fa-fc7de2fc325d}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{6d3bc882-23a4-4706-b8fa-fc7de2fc325d}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces\\DefaultStart", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\AdminCapabilities", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\shellExperience", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateOnHostFlags", "HKEY_USERS", "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\SystemAppData\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\PSR", "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\SystemAppData\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\PSR\\WnfStateName", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesMyComputer", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesRecycleBin", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSetFolders", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoInternetIcon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\identity_helper.exe", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoCommonGroups", "HKEY_CLASSES_ROOT\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\CallForAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\RestrictedAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\FolderValueFlags", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager", "HKEY_CLASSES_ROOT\\Directory", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\ShellEx\\LibraryDescriptionHandler", "HKEY_LOCAL_MACHINE\\Software\\Classes\\Directory\\ShellEx\\LibraryDescriptionHandler", "HKEY_CLASSES_ROOT\\Folder", "HKEY_CURRENT_USER\\Software\\Classes\\Folder\\ShellEx\\LibraryDescriptionHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\LibraryDescriptionHandler", "HKEY_CLASSES_ROOT\\AllFilesystemObjects", "HKEY_CURRENT_USER\\Software\\Classes\\AllFilesystemObjects\\ShellEx\\LibraryDescriptionHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\LibraryDescriptionHandler", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Data", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DontShowSuperHidden", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoWebView", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\ClassicShell", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\SeparateProcess", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoNetCrawling", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowCompColor", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\DontPrettyPath", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowInfoTip", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideIcons", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\MapNetDrvBtn", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\WebView", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Filter", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\SeparateProcess", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\NoNetCrawling", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\AutoCheckSelect", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\IconsOnly", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowTypeOverlay", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowStatusBar", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\ShellEx\\IconHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\IconHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\IconHandler", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\DocObject", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\DocObject", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\BrowseInPlace", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\BrowseInPlace", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\BrowseInPlace", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\Clsid", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\Clsid", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\Clsid", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\IsShortcut", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\IsShortcut", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Data", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\AlwaysShowExt", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\NeverShowExt", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\NeverShowExt", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Generation", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResource", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PropertyBag", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Start Menu", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PropertyBag", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Start Menu", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PropertyBag", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Recent", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PropertyBag", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PropertyBag", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PropertyBag", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Personal", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PropertyBag", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\ShellEx\\PropertyHandler", "HKEY_LOCAL_MACHINE\\Software\\Classes\\Directory\\ShellEx\\PropertyHandler", "HKEY_CURRENT_USER\\Software\\Classes\\Folder\\ShellEx\\PropertyHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\PropertyHandler", "HKEY_CURRENT_USER\\Software\\Classes\\AllFilesystemObjects\\ShellEx\\PropertyHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\PropertyHandler", "HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions", "HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}\\DriveMask", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration", "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalService", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RunAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateAtStorage", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ROTFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppIDFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\MGOTFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProcessMitigationPolicy", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LaunchPermission", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyAuthenticationLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyImpersonationLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AuthenticationLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RemoteServerName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\SRPTrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\PreferredServerBitness", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LoadUserSettings", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProtectionLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AccessPermission", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc\\Extensions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\Extensions\\NdrOleExtDLL", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\ThreadingModel", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\GipActivityBypass", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppID", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\Elevation", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{75121952-E0D0-43E5-9380-1D80483ACF72}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{75121952-e0d0-43e5-9380-1d80483acf72}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{75121952-e0d0-43e5-9380-1d80483acf72}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\ThreadingModel", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\AppID", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\Elevation" ], "read_keys": [ "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\channel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ap", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\name", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-AU", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-AU", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-AU", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\OEM\\DeviceForm", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\UBR", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\DefaultAccessPermission", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E1CDD77A-65D3-4db0-B339-21F6A48CC2FF}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000035-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{50ac103f-d235-4598-bbef-98fe4d1a3ad4}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7ab93c52-0e48-4750-ba9d-1a4113981847}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5caddc63-01d3-4c97-986f-0533483fee14}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers\\WaitForRestore", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\PolicyType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Behavior", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirectMapped", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyname", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyismultisz", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicymultiszSeparatorChar", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataDevice", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataBoth", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\30Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\PolicyType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\MergeAlgorithm", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirectMapped", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirect", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyismultisz", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicymultiszSeparatorChar", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataDevice", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataBoth", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\30Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\PolicyType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Behavior", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\MergeAlgorithm", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirectMapped", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirect", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicypath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyismultisz", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicymultiszSeparatorChar", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataDevice", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataBoth", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\30Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\PolicyType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Behavior", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\MergeAlgorithm", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirectMapped", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirect", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyismultisz", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicymultiszSeparatorChar", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataDevice", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataBoth", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\30Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{84103ccb-2fd7-4d6c-962e-5d8582b4c720}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{a819f3de-60aa-5159-8407-f0a7fb1f6832}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5232f8ea-49c7-4840-bfbb-66e785689e88}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{679C64B7-81AB-42C2-8819-C958767753F4}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0450ce77-af0d-40ac-93fd-1e5d48c89419}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{195f5943-0c04-4eab-b907-735817fdac77}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{F655B052-348B-4AB0-947B-A7DAFA44D404}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\MergeAlgorithm", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirect", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Behavior", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2A1821FE-179D-49BC-B79D-A527920D3665}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C5543B33-5C73-4DC5-9211-24077D3B06C5}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\Expiration", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\XAML\\OneCoreTransformsEnabledByDefault", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\IdentityType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExplicitPsmActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{350E1244-4575-45EE-8595-0AA8C6506FC7}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{100EB64B-B24C-4C38-8964-720D926D05A4}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{b3f72108-5c5c-469b-a5e5-3f64d2a39b01}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{d81e96f1-a89c-417e-9335-59531026309d}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bed20a5-6dee-4297-b976-3b30df69a7aa}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7f290da0-75e3-5885-898d-1f5b1ed47ed2}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9ed07b24-36fd-543b-948e-b01fe5814b49}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{efe869fc-5841-55f1-aa56-82c7219aaa09}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{e44ea1df-bb85-5a8c-bddc-c8e960c355c9}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8cbd762a-1222-5ee5-b745-489e7a42c6ec}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{6d3bc882-23a4-4706-b8fa-fc7de2fc325d}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces\\DefaultStart", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\shellExperience", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateOnHostFlags", "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\SystemAppData\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\PSR\\WnfStateName", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesMyComputer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesRecycleBin", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSetFolders", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoInternetIcon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoCommonGroups", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\CallForAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\RestrictedAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\FolderValueFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Data", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DontShowSuperHidden", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoWebView", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\ClassicShell", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\SeparateProcess", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoNetCrawling", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowCompColor", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\DontPrettyPath", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowInfoTip", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideIcons", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\MapNetDrvBtn", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\WebView", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Filter", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\SeparateProcess", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\NoNetCrawling", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\AutoCheckSelect", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\IconsOnly", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowTypeOverlay", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowStatusBar", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\DocObject", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\DocObject", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\BrowseInPlace", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\BrowseInPlace", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\IsShortcut", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\IsShortcut", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Data", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\AlwaysShowExt", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\NeverShowExt", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\NeverShowExt", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Generation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InitFolderHandler", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Start Menu", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Start Menu", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InitFolderHandler", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Recent", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InitFolderHandler", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Personal", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}\\DriveMask", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalService", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RunAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateAtStorage", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ROTFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppIDFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\MGOTFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProcessMitigationPolicy", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LaunchPermission", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyAuthenticationLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyImpersonationLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AuthenticationLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RemoteServerName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\SRPTrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\PreferredServerBitness", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LoadUserSettings", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProtectionLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AccessPermission", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\Extensions\\NdrOleExtDLL", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\GipActivityBypass", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{75121952-e0d0-43e5-9380-1d80483acf72}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\AppID" ], "write_keys": [], "delete_keys": [], "executed_commands": [ "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=crashpad-handler \"--user-data-dir=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=148.0.7778.180 \"--annotation=exe=C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=148.0.3967.83 --initial-client-data=0x354,0x358,0x35c,0x34c,0x364,0x7ffb85295d58,0x7ffb85295d64,0x7ffb85295d70", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=2412,i,9254761530843504222,7616292111383238981,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2588 /prefetch:3", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2172,i,4642495680772319387,17118116984640679203,262144 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2312 /prefetch:2", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2672,i,15125762378853465392,758582465602508720,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2676 /prefetch:8", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780011216982031 --launch-time-ticks=50635969 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3584,i,14196480617990583521,17268836115555013304,2097152 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3596 /prefetch:1", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780011216982031 --launch-time-ticks=50638248 --skip-read-main-dll --metrics-shmem-handle=3612,i,13922137629094413072,6799869366371709248,2097152 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3696 /prefetch:1", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --skip-read-main-dll --metrics-shmem-handle=5208,i,5495702585828010850,3819205297865186319,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3576 /prefetch:8", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=3960,i,4728933953316391,13056253408553037665,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3568 /prefetch:8", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5816,i,7984218614831481947,5522388298470254199,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5860 /prefetch:8", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --skip-read-main-dll --metrics-shmem-handle=5928,i,5358152234413628994,12107027077339134663,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5944 /prefetch:8", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1780011216982031 --launch-time-ticks=52463920 --skip-read-main-dll --metrics-shmem-handle=5996,i,12708371531593665223,15506833222681786947,2097152 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=6000 /prefetch:1", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=6996,i,10244934382733242657,13532683168228175185,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=7000 /prefetch:8", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=7088,i,8913639506253746188,10001621401996875507,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=6996 /prefetch:8", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=6972,i,6352578797868847121,17012287025672144076,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=6948 /prefetch:8", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window", "\"C:\\Windows\\SystemApps\\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\\CHXSmartScreen.exe\" -ServerName:App.AppXk7vvv12h4qrkhkbvf6j86ja45mzj5km9.mca", "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" ], "resolved_apis": [], "mutexes": [ "Local\\SM0:9452:304:WilStaging_02", "Local\\SM0:9452:120:WilError_03", "Local\\SM0:8996:304:WilStaging_02" ], "created_services": [], "started_services": [ "MicrosoftEdgeElevationService" ] }, "enhanced": [ { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:18,834", "eid": 1, "data": { "file": "user32", "pathtofile": null, "moduleaddress": "0x7ffbc77b0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:19,599", "eid": 2, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,224", "eid": 3, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,240", "eid": 4, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,240", "eid": 5, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,240", "eid": 6, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,240", "eid": 7, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,240", "eid": 8, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,240", "eid": 9, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,240", "eid": 10, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,240", "eid": 11, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,240", "eid": 12, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,240", "eid": 13, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,240", "eid": 14, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,240", "eid": 15, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,240", "eid": 16, "data": { "file": "C:\\Windows\\System32\\dlnashext.dll", "pathtofile": null, "moduleaddress": "0x7ffbb9d80000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,240", "eid": 17, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,256", "eid": 18, "data": { "file": "C:\\Windows\\System32\\wpdshext.dll", "pathtofile": null, "moduleaddress": "0x7ffbb4520000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,256", "eid": 19, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,256", "eid": 20, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,256", "eid": 21, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,256", "eid": 22, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,256", "eid": 23, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,256", "eid": 24, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,256", "eid": 25, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,256", "eid": 26, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,256", "eid": 27, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,256", "eid": 28, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,256", "eid": 29, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,256", "eid": 30, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,256", "eid": 31, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,256", "eid": 32, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,256", "eid": 33, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,256", "eid": 34, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,256", "eid": 35, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,256", "eid": 36, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,256", "eid": 37, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 38, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 39, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 40, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 41, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 42, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 43, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 44, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 45, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 46, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 47, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 48, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 49, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 50, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 51, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 52, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 53, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 54, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 55, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 56, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 57, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 58, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 59, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 60, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 61, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 62, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 63, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 64, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 65, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 66, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 67, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 68, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 69, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 70, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 71, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 72, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 73, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 74, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 75, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 76, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 77, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 78, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 79, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 80, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 81, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 82, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,271", "eid": 83, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 84, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 85, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 86, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 87, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 88, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 89, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 90, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 91, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 92, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 93, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 94, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 95, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 96, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 97, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 98, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 99, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 100, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 101, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 102, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 103, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 104, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 105, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 106, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 107, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 108, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 109, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 110, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 111, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 112, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 113, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 114, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 115, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 116, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 117, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 118, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 119, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 120, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 121, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 122, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 123, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 124, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 125, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,287", "eid": 126, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,302", "eid": 127, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,302", "eid": 128, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,302", "eid": 129, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,302", "eid": 130, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,302", "eid": 131, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,318", "eid": 132, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,318", "eid": 133, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,318", "eid": 134, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,334", "eid": 135, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,334", "eid": 136, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,334", "eid": 137, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,334", "eid": 138, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,349", "eid": 139, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,349", "eid": 140, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,349", "eid": 141, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,365", "eid": 142, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:20,365", "eid": 143, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:21,552", "eid": 144, "data": { "file": "C:\\Windows\\System32\\execmodelclient.dll", "pathtofile": null, "moduleaddress": "0x7ffbb5020000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:21,568", "eid": 145, "data": { "file": "ploptin.dll", "pathtofile": null, "moduleaddress": "0x7ffbba650000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:21,568", "eid": 146, "data": { "file": "ploptin.dll", "pathtofile": null, "moduleaddress": "0x7ffbba650000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:21,568", "eid": 147, "data": { "file": "ploptin.dll", "pathtofile": null, "moduleaddress": "0x7ffbba650000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:22,709", "eid": 148, "data": { "file": "C:\\Windows\\System32\\windows.internal.shell.broker.dll", "pathtofile": null, "moduleaddress": "0x7ffbac200000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:22,756", "eid": 149, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:22,756", "eid": 150, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:22,771", "eid": 151, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:22,771", "eid": 152, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:23,537", "eid": 153, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:24,115", "eid": 154, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:24,615", "eid": 155, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:27,709", "eid": 156, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:27,709", "eid": 157, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:27,709", "eid": 158, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:27,724", "eid": 159, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:27,724", "eid": 160, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:29,552", "eid": 161, "data": { "file": "comctl32.dll", "pathtofile": null, "moduleaddress": "0x7ffbb1750000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:31,912", "eid": 162, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:32,506", "eid": 163, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:32,521", "eid": 164, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:34,240", "eid": 165, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:38,521", "eid": 166, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7ffbc4230000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:52,927", "eid": 167, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:52,943", "eid": 168, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:58,412", "eid": 169, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:58,427", "eid": 170, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:58,427", "eid": 171, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:58,427", "eid": 172, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:58,740", "eid": 173, "data": { "file": "C:\\Windows\\System32\\Windows.Shell.ServiceHostBuilder.dll", "pathtofile": null, "moduleaddress": "0x7ffbb4b60000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:58,756", "eid": 174, "data": { "file": "D3D10Warp.dll", "pathtofile": null, "moduleaddress": "0x7ffbbdd10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:58,756", "eid": 175, "data": { "file": "gdi32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc6d10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:58,756", "eid": 176, "data": { "file": "d3d10warp.dll", "pathtofile": null, "moduleaddress": "0x7ffbbdd10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:58,771", "eid": 177, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:58,771", "eid": 178, "data": { "file": "C:\\Windows\\System32\\activationclient.dll", "pathtofile": null, "moduleaddress": "0x7ffbbd8b0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:58,834", "eid": 179, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:58,849", "eid": 180, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:59,412", "eid": 181, "data": { "file": "gdi32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc6d10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:59,412", "eid": 182, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:59,912", "eid": 183, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:00,068", "eid": 184, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:00,084", "eid": 185, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:00,084", "eid": 186, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:00,646", "eid": 187, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:00,662", "eid": 188, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:00,662", "eid": 189, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:00,693", "eid": 190, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:01,099", "eid": 191, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7ffbc4230000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:02,256", "eid": 192, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:02,256", "eid": 193, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,224", "eid": 194, "data": { "file": "comctl32.dll", "pathtofile": null, "moduleaddress": "0x7ffbb1750000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,224", "eid": 195, "data": { "file": "C:\\Windows\\System32\\twext.dll", "pathtofile": null, "moduleaddress": "0x7ffbaf610000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,240", "eid": 196, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,240", "eid": 197, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-28 23:35:04,256", "eid": 198, "data": { "file": "" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,271", "eid": 199, "data": { "file": "comctl32.dll", "pathtofile": null, "moduleaddress": "0x7ffbb1750000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,271", "eid": 200, "data": { "file": "C:\\Windows\\System32\\duser.dll", "pathtofile": null, "moduleaddress": "0x7ffbb6860000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,287", "eid": 201, "data": { "file": "user32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc77b0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,287", "eid": 202, "data": { "file": "MsftEdit.dll", "pathtofile": null, "moduleaddress": "0x7ffbaa9a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,302", "eid": 203, "data": { "file": "ole32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc7560000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,302", "eid": 204, "data": { "file": "C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll", "pathtofile": null, "moduleaddress": "0x7ffb6d450000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,302", "eid": 205, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,318", "eid": 206, "data": { "file": "C:\\Windows\\System32\\UIRibbon.dll", "pathtofile": null, "moduleaddress": "0x7ffb6d060000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,318", "eid": 207, "data": { "file": "atlthunk.dll", "pathtofile": null, "moduleaddress": "0x7ffbaa3d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,318", "eid": 208, "data": { "file": "C:\\Windows\\System32\\UIRibbon.dll", "pathtofile": null, "moduleaddress": "0x7ffb6d060000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,318", "eid": 209, "data": { "file": "Comctl32.dll", "pathtofile": null, "moduleaddress": "0x7ffbb1750000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,334", "eid": 210, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,334", "eid": 211, "data": { "file": "Ntdll.dll", "pathtofile": null, "moduleaddress": "0x7ffbc7b50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,349", "eid": 212, "data": { "file": "C:\\Windows\\System32\\uiautomationcore.dll", "pathtofile": null, "moduleaddress": "0x7ffbabdd0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,349", "eid": 213, "data": { "file": "UIAutomationCore.dll", "pathtofile": null, "moduleaddress": "0x7ffbabdd0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,349", "eid": 214, "data": { "file": "C:\\Windows\\System32\\UIAutomationCore.dll", "pathtofile": null, "moduleaddress": "0x7ffbabdd0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,365", "eid": 215, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,381", "eid": 216, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,381", "eid": 217, "data": { "file": "C:\\Windows\\System32\\xmllite.dll", "pathtofile": null, "moduleaddress": "0x7ffbc0d70000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,381", "eid": 218, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,381", "eid": 219, "data": { "file": "C:\\Windows\\System32\\xmllite.dll", "pathtofile": null, "moduleaddress": "0x7ffbc0d70000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,412", "eid": 220, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,427", "eid": 221, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,427", "eid": 222, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,427", "eid": 223, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,427", "eid": 224, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,427", "eid": 225, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,443", "eid": 226, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,443", "eid": 227, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,443", "eid": 228, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,443", "eid": 229, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,474", "eid": 230, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,474", "eid": 231, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,490", "eid": 232, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,490", "eid": 233, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,490", "eid": 234, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,490", "eid": 235, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,506", "eid": 236, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,506", "eid": 237, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,177", "eid": 238, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,177", "eid": 239, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,209", "eid": 240, "data": { "file": "C:\\Windows\\System32\\drprov.dll", "pathtofile": null, "moduleaddress": "0x7ffbc0930000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,240", "eid": 241, "data": { "file": "C:\\Windows\\System32\\ntlanman.dll", "pathtofile": null, "moduleaddress": "0x7ffbb4ac0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,240", "eid": 242, "data": { "file": "C:\\Windows\\System32\\davclnt.dll", "pathtofile": null, "moduleaddress": "0x7ffbb4500000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,240", "eid": 243, "data": { "file": "C:\\Windows\\System32\\drprov.dll", "pathtofile": null, "moduleaddress": "0x7ffbc0930000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,240", "eid": 244, "data": { "file": "C:\\Windows\\System32\\ntlanman.dll", "pathtofile": null, "moduleaddress": "0x7ffbb4ac0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,240", "eid": 245, "data": { "file": "cscapi.dll", "pathtofile": null, "moduleaddress": "0x7ffbb1a70000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,240", "eid": 246, "data": { "file": "C:\\Windows\\System32\\davclnt.dll", "pathtofile": null, "moduleaddress": "0x7ffbb4500000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,240", "eid": 247, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,240", "eid": 248, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,240", "eid": 249, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,256", "eid": 250, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,256", "eid": 251, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,256", "eid": 252, "data": { "file": "C:\\Windows\\System32\\PlayToDevice.dll", "pathtofile": null, "moduleaddress": "0x7ffb6cff0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,271", "eid": 253, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,271", "eid": 254, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,271", "eid": 255, "data": { "file": "Comctl32.dll", "pathtofile": null, "moduleaddress": "0x7ffbb1750000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,271", "eid": 256, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,271", "eid": 257, "data": { "file": "C:\\Windows\\System32\\EhStorAPI.dll", "pathtofile": null, "moduleaddress": "0x7ffbb2520000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,287", "eid": 258, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,287", "eid": 259, "data": { "file": "C:\\Windows\\System32\\xmllite.dll", "pathtofile": null, "moduleaddress": "0x7ffbc0d70000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,287", "eid": 260, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,287", "eid": 261, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,334", "eid": 262, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,334", "eid": 263, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,334", "eid": 264, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,334", "eid": 265, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,334", "eid": 266, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,334", "eid": 267, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,349", "eid": 268, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,349", "eid": 269, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,349", "eid": 270, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,349", "eid": 271, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,349", "eid": 272, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,349", "eid": 273, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,349", "eid": 274, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,349", "eid": 275, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:07,349", "eid": 276, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:08,271", "eid": 277, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:08,271", "eid": 278, "data": { "file": "C:\\Windows\\System32\\xmllite.dll", "pathtofile": null, "moduleaddress": "0x7ffbc0d70000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:08,271", "eid": 279, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:08,271", "eid": 280, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:08,287", "eid": 281, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:08,287", "eid": 282, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:08,287", "eid": 283, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:08,287", "eid": 284, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:08,287", "eid": 285, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:08,287", "eid": 286, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:08,287", "eid": 287, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:08,396", "eid": 288, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:08,443", "eid": 289, "data": { "file": "C:\\Windows\\System32\\ntshrui.dll", "pathtofile": null, "moduleaddress": "0x7ffbaf650000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:08,459", "eid": 290, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:08,943", "eid": 291, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:08,959", "eid": 292, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:08,959", "eid": 293, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:09,115", "eid": 294, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:09,131", "eid": 295, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:09,287", "eid": 296, "data": { "file": "D3D10Warp.dll", "pathtofile": null, "moduleaddress": "0x7ffbbdd10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:09,287", "eid": 297, "data": { "file": "gdi32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc6d10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:09,287", "eid": 298, "data": { "file": "d3d10warp.dll", "pathtofile": null, "moduleaddress": "0x7ffbbdd10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:09,318", "eid": 299, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-28 23:34:27,296", "eid": 300, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=crashpad-handler \"--user-data-dir=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=148.0.7778.180 \"--annotation=exe=C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=148.0.3967.83 --initial-client-data=0x354,0x358,0x35c,0x34c,0x364,0x7ffb85295d58,0x7ffb85295d64,0x7ffb85295d70" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-28 23:34:27,453", "eid": 301, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=2412,i,9254761530843504222,7616292111383238981,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2588 /prefetch:3" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-28 23:34:27,468", "eid": 302, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2172,i,4642495680772319387,17118116984640679203,262144 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2312 /prefetch:2" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-28 23:34:27,484", "eid": 303, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2672,i,15125762378853465392,758582465602508720,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2676 /prefetch:8" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-28 23:34:27,609", "eid": 304, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780011216982031 --launch-time-ticks=50635969 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3584,i,14196480617990583521,17268836115555013304,2097152 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3596 /prefetch:1" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-28 23:34:27,609", "eid": 305, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780011216982031 --launch-time-ticks=50638248 --skip-read-main-dll --metrics-shmem-handle=3612,i,13922137629094413072,6799869366371709248,2097152 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3696 /prefetch:1" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-28 23:34:29,375", "eid": 306, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=3960,i,4728933953316391,13056253408553037665,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3568 /prefetch:8" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-28 23:34:29,375", "eid": 307, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --skip-read-main-dll --metrics-shmem-handle=5208,i,5495702585828010850,3819205297865186319,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3576 /prefetch:8" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-28 23:34:29,453", "eid": 308, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --skip-read-main-dll --metrics-shmem-handle=5928,i,5358152234413628994,12107027077339134663,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5944 /prefetch:8" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-28 23:34:29,453", "eid": 309, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1780011216982031 --launch-time-ticks=52463920 --skip-read-main-dll --metrics-shmem-handle=5996,i,12708371531593665223,15506833222681786947,2097152 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=6000 /prefetch:1" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-28 23:34:30,125", "eid": 310, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5816,i,7984218614831481947,5522388298470254199,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5860 /prefetch:8" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-28 23:34:50,937", "eid": 311, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=6996,i,10244934382733242657,13532683168228175185,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=7000 /prefetch:8" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-28 23:34:56,656", "eid": 312, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=7088,i,8913639506253746188,10001621401996875507,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=6996 /prefetch:8" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-28 23:34:57,406", "eid": 313, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=6972,i,6352578797868847121,17012287025672144076,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510747,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=6948 /prefetch:8" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,436", "eid": 314, "data": { "file": "api-ms-win-core-fibers-l1-1-2", "pathtofile": null, "moduleaddress": "0x7ffbc5420000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,436", "eid": 315, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,436", "eid": 316, "data": { "file": "bcryptprimitives.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5750000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,436", "eid": 317, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,436", "eid": 318, "data": { "file": "api-ms-win-core-localization-l1-2-1", "pathtofile": null, "moduleaddress": "0x7ffbc5420000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,436", "eid": 319, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,436", "eid": 320, "data": { "file": "kernel32", "pathtofile": null, "moduleaddress": "0x7ffbc6480000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,436", "eid": 321, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,436", "eid": 322, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,436", "eid": 323, "data": { "file": "api-ms-win-core-string-l1-1-0", "pathtofile": null, "moduleaddress": "0x7ffbc5420000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,436", "eid": 324, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,436", "eid": 325, "data": { "file": "api-ms-win-core-datetime-l1-1-1", "pathtofile": null, "moduleaddress": "0x7ffbc5420000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,436", "eid": 326, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,436", "eid": 327, "data": { "file": "api-ms-win-core-localization-obsolete-l1-2-0", "pathtofile": null, "moduleaddress": "0x7ffbc5420000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,436", "eid": 328, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,436", "eid": 329, "data": { "file": "bcryptprimitives.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5750000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,436", "eid": 330, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,436", "eid": 331, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,436", "eid": 332, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\channel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,436", "eid": 333, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\channel", "content": "stable" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,452", "eid": 334, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ap", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,452", "eid": 335, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\name", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,452", "eid": 336, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\name", "content": "" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,452", "eid": 337, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-AU", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,452", "eid": 338, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-AU", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,452", "eid": 339, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx", "content": "kernel32.dll" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,452", "eid": 340, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc6480000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,452", "eid": 341, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,452", "eid": 342, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-AU", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,452", "eid": 343, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,452", "eid": 344, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc6480000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,452", "eid": 345, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,452", "eid": 346, "data": { "file": "api-ms-win-core-file-l1-2-1.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5420000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,452", "eid": 347, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,561", "eid": 348, "data": { "file": "api-ms-win-core-fibers-l1-1-2", "pathtofile": null, "moduleaddress": "0x7ffbc5420000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,561", "eid": 349, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,561", "eid": 350, "data": { "file": "bcryptprimitives.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5750000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,561", "eid": 351, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,577", "eid": 352, "data": { "file": "api-ms-win-core-localization-l1-2-1", "pathtofile": null, "moduleaddress": "0x7ffbc5420000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,577", "eid": 353, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,577", "eid": 354, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,577", "eid": 355, "data": { "file": "kernel32", "pathtofile": null, "moduleaddress": "0x7ffbc6480000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,577", "eid": 356, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,577", "eid": 357, "data": { "file": "api-ms-win-core-string-l1-1-0", "pathtofile": null, "moduleaddress": "0x7ffbc5420000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,577", "eid": 358, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,577", "eid": 359, "data": { "file": "api-ms-win-core-datetime-l1-1-1", "pathtofile": null, "moduleaddress": "0x7ffbc5420000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,577", "eid": 360, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,577", "eid": 361, "data": { "file": "api-ms-win-core-localization-obsolete-l1-2-0", "pathtofile": null, "moduleaddress": "0x7ffbc5420000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,577", "eid": 362, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,577", "eid": 363, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,577", "eid": 364, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\OEM\\DeviceForm", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,577", "eid": 365, "data": { "file": "api-ms-win-downlevel-shell32-l1-1-0.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5c20000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,577", "eid": 366, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,577", "eid": 367, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,577", "eid": 368, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,577", "eid": 369, "data": { "file": "bcryptprimitives.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5750000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,577", "eid": 370, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,577", "eid": 371, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,608", "eid": 372, "data": { "file": "api-ms-win-core-fibers-l1-1-2", "pathtofile": null, "moduleaddress": "0x7ffbc5420000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,608", "eid": 373, "data": { "file": "bcryptprimitives.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5750000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,608", "eid": 374, "data": { "file": "api-ms-win-core-localization-l1-2-1", "pathtofile": null, "moduleaddress": "0x7ffbc5420000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,608", "eid": 375, "data": { "file": "kernel32", "pathtofile": null, "moduleaddress": "0x7ffbc6480000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,608", "eid": 376, "data": { "file": "api-ms-win-core-string-l1-1-0", "pathtofile": null, "moduleaddress": "0x7ffbc5420000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,608", "eid": 377, "data": { "file": "api-ms-win-core-datetime-l1-1-1", "pathtofile": null, "moduleaddress": "0x7ffbc5420000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,608", "eid": 378, "data": { "file": "api-ms-win-core-localization-obsolete-l1-2-0", "pathtofile": null, "moduleaddress": "0x7ffbc5420000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,608", "eid": 379, "data": { "file": "bcryptprimitives.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5750000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,608", "eid": 380, "data": { "file": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge.dll", "pathtofile": null, "moduleaddress": "0x1bceb000000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,608", "eid": 381, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,608", "eid": 382, "data": { "file": "ucrtbase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,608", "eid": 383, "data": { "file": "ADVAPI32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc65a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,608", "eid": 384, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,608", "eid": 385, "data": { "file": "C:\\Windows\\System32\\uxtheme.dll", "pathtofile": null, "moduleaddress": "0x7ffbc2bf0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,608", "eid": 386, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,608", "eid": 387, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme", "content": "1" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,608", "eid": 388, "data": { "file": "Kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,624", "eid": 389, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,624", "eid": 390, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,624", "eid": 391, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,624", "eid": 392, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,624", "eid": 393, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\OEM\\DeviceForm", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,624", "eid": 394, "data": { "file": "USER32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc77b0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,624", "eid": 395, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,624", "eid": 396, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,624", "eid": 397, "data": { "file": "api-ms-win-core-wow64-l1-1-1.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,624", "eid": 398, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\UBR", "content": "3803" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,624", "eid": 399, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion", "content": "22H2" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,624", "eid": 400, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,624", "eid": 401, "data": { "file": "Kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,624", "eid": 402, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,639", "eid": 403, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,639", "eid": 404, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:30,639", "eid": 405, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 23:34:30,639", "eid": 406, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:30,639", "eid": 407, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 23:34:30,639", "eid": 408, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:30,639", "eid": 409, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 23:34:30,639", "eid": 410, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:30,639", "eid": 411, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 23:34:30,639", "eid": 412, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:30,639", "eid": 413, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 23:34:30,639", "eid": 414, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:30,639", "eid": 415, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:30,655", "eid": 416, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:30,655", "eid": 417, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 23:34:30,655", "eid": 418, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:30,655", "eid": 419, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 23:34:30,655", "eid": 420, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:30,655", "eid": 421, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,655", "eid": 422, "data": { "file": "api-ms-win-core-winrt-l1-1-0.dll", "pathtofile": null, "moduleaddress": "0x7ffbc71d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,655", "eid": 423, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:30,655", "eid": 424, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,655", "eid": 425, "data": { "file": "C:\\Windows\\system32\\rpcss.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 23:34:30,655", "eid": 426, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:30,655", "eid": 427, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 23:34:30,655", "eid": 428, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:30,655", "eid": 429, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 23:34:30,655", "eid": 430, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:30,655", "eid": 431, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 23:34:30,655", "eid": 432, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:30,655", "eid": 433, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 23:34:30,655", "eid": 434, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:30,655", "eid": 435, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:30,655", "eid": 436, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:30,655", "eid": 437, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:30,655", "eid": 438, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:30,655", "eid": 439, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 23:34:30,655", "eid": 440, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 23:34:30,655", "eid": 441, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:30,655", "eid": 442, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,655", "eid": 443, "data": { "file": "api-ms-win-core-winrt-string-l1-1-0.dll", "pathtofile": null, "moduleaddress": "0x7ffbc71d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,655", "eid": 444, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:30,655", "eid": 445, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:30,655", "eid": 446, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,655", "eid": 447, "data": { "file": "combase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:30,655", "eid": 448, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,655", "eid": 449, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,686", "eid": 450, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,686", "eid": 451, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,686", "eid": 452, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\DllPath", "content": "C:\\Windows\\System32\\execmodelclient.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,686", "eid": 453, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,686", "eid": 454, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\TrustLevel", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,686", "eid": 455, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,686", "eid": 456, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,686", "eid": 457, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,686", "eid": 458, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,702", "eid": 459, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,702", "eid": 460, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,702", "eid": 461, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,717", "eid": 462, "data": { "file": "C:\\Windows\\System32\\execmodelclient.dll", "pathtofile": null, "moduleaddress": "0x7ffbb5020000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,717", "eid": 463, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,780", "eid": 464, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,780", "eid": 465, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,780", "eid": 466, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\DllPath", "content": "C:\\Windows\\System32\\combase.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,780", "eid": 467, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,780", "eid": 468, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,780", "eid": 469, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,780", "eid": 470, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,780", "eid": 471, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,780", "eid": 472, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,780", "eid": 473, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,780", "eid": 474, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,780", "eid": 475, "data": { "file": "C:\\Windows\\System32\\combase.dll", "pathtofile": null, "moduleaddress": "0x7ffbc71d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,795", "eid": 476, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,795", "eid": 477, "data": { "file": "ole32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc7560000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,795", "eid": 478, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,795", "eid": 479, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,795", "eid": 480, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,795", "eid": 481, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\DllPath", "content": "C:\\Windows\\System32\\wpnapps.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,795", "eid": 482, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Threading", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,795", "eid": 483, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\TrustLevel", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,795", "eid": 484, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,795", "eid": 485, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,795", "eid": 486, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,795", "eid": 487, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,795", "eid": 488, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,795", "eid": 489, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Permissions", "content": "\\x01\\x00\\x14\\x80$\\x01\\x00\\x000\\x01\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00\\xf4\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x13\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x14\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x0b\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\t\\x00L\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x04\\x00\\x00\\x00artx\\xf8.\\x00\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00I\\x00S\\x00M\\x00U\\x00L\\x00T\\x00I\\x00S\\x00E\\x00S\\x00S\\x00I\\x00O\\x00N\\x00S\\x00K\\x00U\\x00\\xa2\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,795", "eid": 490, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,858", "eid": 491, "data": { "file": "C:\\Windows\\System32\\wpnapps.dll", "pathtofile": null, "moduleaddress": "0x7ffbb08e0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,858", "eid": 492, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,874", "eid": 493, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,874", "eid": 494, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,874", "eid": 495, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,874", "eid": 496, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,874", "eid": 497, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,874", "eid": 498, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\DefaultAccessPermission", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,889", "eid": 499, "data": { "file": "C:\\Windows\\system32\\rpcss.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,889", "eid": 500, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "content": "{00000320-0000-0000-C000-000000000046}" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,920", "eid": 501, "data": { "file": "combase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 502, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E1CDD77A-65D3-4db0-B339-21F6A48CC2FF}\\ProxyStubClsid32\\(Default)", "content": "{00000320-0000-0000-C000-000000000046}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 503, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000035-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "content": "{00000320-0000-0000-C000-000000000046}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 504, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32\\(Default)", "content": "{00000320-0000-0000-C000-000000000046}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 505, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 506, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 507, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 508, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 509, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{50ac103f-d235-4598-bbef-98fe4d1a3ad4}\\ProxyStubClsid32\\(Default)", "content": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 510, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)", "content": "%systemroot%\\system32\\execmodelproxy.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 511, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)", "content": "%systemroot%\\system32\\execmodelproxy.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 512, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 513, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 514, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 515, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\(Default)", "content": "Windows Push Notification Developer Proxy Stub" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 516, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 517, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 518, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 519, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)", "content": "%SystemRoot%\\System32\\wpnapps.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 520, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\(Default)", "content": "ExecModelProxy" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 521, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 522, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 523, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)", "content": "%systemroot%\\system32\\execmodelproxy.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 524, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)", "content": "%systemroot%\\system32\\execmodelproxy.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 525, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 526, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 527, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 528, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 529, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 530, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)", "content": "%SystemRoot%\\System32\\wpnapps.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 531, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\AppID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 532, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7ab93c52-0e48-4750-ba9d-1a4113981847}\\ProxyStubClsid32\\(Default)", "content": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,920", "eid": 533, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5caddc63-01d3-4c97-986f-0533483fee14}\\ProxyStubClsid32\\(Default)", "content": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,952", "eid": 534, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\ActivateOnHostFlags", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,952", "eid": 535, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,952", "eid": 536, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\(Default)", "content": "Windows Push Notification Platform" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,952", "eid": 537, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers\\WaitForRestore", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,952", "eid": 538, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,952", "eid": 539, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,952", "eid": 540, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,952", "eid": 541, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,952", "eid": 542, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,952", "eid": 543, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,952", "eid": 544, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,952", "eid": 545, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "content": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 546, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 547, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 548, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 549, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 550, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\PolicyType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 551, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Behavior", "content": "139296" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 552, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 553, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 554, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 555, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyname", "content": "LetAppsRunInBackground_UserInControlOfTheseApps" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 556, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 557, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath", "content": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 558, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 559, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyismultisz", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 560, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicymultiszSeparatorChar", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 561, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 562, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 563, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 564, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 565, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\AppID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 566, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\PolicyType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 567, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\MergeAlgorithm", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 568, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 569, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 570, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 571, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname", "content": "LetAppsRunInBackground_ForceAllowTheseApps" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 572, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 573, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath", "content": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 574, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyismultisz", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 575, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicymultiszSeparatorChar", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 576, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 577, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 578, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 579, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 580, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 581, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\PolicyType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 582, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Behavior", "content": "139296" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 583, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\MergeAlgorithm", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 584, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 585, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 586, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 587, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname", "content": "LetAppsRunInBackground_ForceDenyTheseApps" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 588, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicypath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 589, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicypath", "content": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 590, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyismultisz", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 591, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicymultiszSeparatorChar", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 592, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 593, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 594, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 595, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 596, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 597, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\PolicyType", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 598, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Behavior", "content": "139296" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 599, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\MergeAlgorithm", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 600, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 601, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 602, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 603, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname", "content": "LetAppsRunInBackground" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 604, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 605, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath", "content": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 606, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyismultisz", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 607, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicymultiszSeparatorChar", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 608, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 609, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 610, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 611, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 612, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Value", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 613, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivationType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 614, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Server", "content": "StateRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 615, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\DllPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 616, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Threading", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 617, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,967", "eid": 618, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 619, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 620, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 621, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 622, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 623, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 624, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 625, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 626, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 627, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 628, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions", "content": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 629, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 630, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 631, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 632, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity", "content": "nt authority\\system" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 633, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName", "content": "StateRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 634, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 635, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{84103ccb-2fd7-4d6c-962e-5d8582b4c720}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 636, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 637, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 638, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 639, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 640, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 641, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "content": "C:\\Windows\\System32\\\\Windows.StateRepositoryPS.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 642, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 643, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 644, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 645, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 646, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 647, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 648, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 649, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "content": "C:\\Windows\\System32\\\\Windows.StateRepositoryPS.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 650, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 651, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 652, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{a819f3de-60aa-5159-8407-f0a7fb1f6832}\\ProxyStubClsid32\\(Default)", "content": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,983", "eid": 653, "data": { "file": "C:\\Windows\\System32\\Windows.StateRepositoryPS.dll", "pathtofile": null, "moduleaddress": "0x7ffbb5d90000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:30,983", "eid": 654, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 655, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}\\ProxyStubClsid32\\(Default)", "content": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 656, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5232f8ea-49c7-4840-bfbb-66e785689e88}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 657, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivationType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 658, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 659, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 660, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 661, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 662, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 663, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 664, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 665, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{679C64B7-81AB-42C2-8819-C958767753F4}\\ProxyStubClsid32\\(Default)", "content": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 666, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0450ce77-af0d-40ac-93fd-1e5d48c89419}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,983", "eid": 667, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{195f5943-0c04-4eab-b907-735817fdac77}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:30,999", "eid": 668, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{F655B052-348B-4AB0-947B-A7DAFA44D404}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,014", "eid": 669, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-28 23:34:31,014", "eid": 670, "data": { "regkey": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\HasRepaired" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-28 23:34:31,014", "eid": 671, "data": { "regkey": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\HasRepaired\\VolatileChildTest" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,014", "eid": 672, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,014", "eid": 673, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,014", "eid": 674, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,014", "eid": 675, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid", "content": "S-1-15-2-543634040-274359014-2226501544-3561766748-3991453649-3543631192-522786984" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,014", "eid": 676, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,014", "eid": 677, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids", "content": "\\x03\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x93MhQ\\x18=\\xc3\\xa6(\\x927f\\xc7\\xb1\\xfd\\x1eb\\x11\\xb0\\x8dT\\xad@A8\\xb7l\\xebv\\xc0V\\xd6\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xdc\\xdc\\xc7+\\x1b\\x84\\xfb\\x17\\x8c\\xfd\\xd5\\x99\\x9fj\\xa1T\\xc3\t\\x1a\\xfbT\\xa8\\x98\\xa2\\x98\\xef\\x9b\r\\xe1=\\xaa!\\x01\\x08\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00x2g \\xe6bZ\\x10\\xa8\\xb7\\xb5\\x84\\?L\\xd4\\xd1\\xbf\\xe8\\xedX\\x857\\xd3\\xa8\\x18)\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,014", "eid": 678, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,014", "eid": 679, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,014", "eid": 680, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\PolicyType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,014", "eid": 681, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Behavior", "content": "139296" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,014", "eid": 682, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\MergeAlgorithm", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,014", "eid": 683, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,014", "eid": 684, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,014", "eid": 685, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,014", "eid": 686, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyname", "content": "LetAppsRunInBackground_UserInControlOfTheseApps" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,014", "eid": 687, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,014", "eid": 688, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath", "content": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,014", "eid": 689, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyismultisz", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,014", "eid": 690, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicymultiszSeparatorChar", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,014", "eid": 691, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,014", "eid": 692, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,014", "eid": 693, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,014", "eid": 694, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 695, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 696, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\PolicyType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 697, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Behavior", "content": "139296" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 698, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\MergeAlgorithm", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 699, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 700, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 701, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 702, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname", "content": "LetAppsRunInBackground_ForceAllowTheseApps" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 703, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 704, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath", "content": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 705, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyismultisz", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 706, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicymultiszSeparatorChar", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 707, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 708, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 709, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 710, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 711, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 712, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\PolicyType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 713, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Behavior", "content": "139296" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 714, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\MergeAlgorithm", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 715, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 716, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 717, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 718, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname", "content": "LetAppsRunInBackground_ForceDenyTheseApps" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 719, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicypath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 720, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicypath", "content": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 721, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyismultisz", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 722, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicymultiszSeparatorChar", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 723, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 724, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 725, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 726, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 727, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 728, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Behavior", "content": "139296" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 729, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2A1821FE-179D-49BC-B79D-A527920D3665}\\ProxyStubClsid32\\(Default)", "content": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 730, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\MergeAlgorithm", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 731, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 732, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 733, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 734, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname", "content": "LetAppsRunInBackground" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 735, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 736, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath", "content": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 737, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyismultisz", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 738, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicymultiszSeparatorChar", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 739, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 740, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 741, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 742, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 743, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Value", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 744, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 745, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 746, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 747, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid", "content": "S-1-15-2-543634040-274359014-2226501544-3561766748-3991453649-3543631192-522786984" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 748, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 749, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids", "content": "\\x03\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x93MhQ\\x18=\\xc3\\xa6(\\x927f\\xc7\\xb1\\xfd\\x1eb\\x11\\xb0\\x8dT\\xad@A8\\xb7l\\xebv\\xc0V\\xd6\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xdc\\xdc\\xc7+\\x1b\\x84\\xfb\\x17\\x8c\\xfd\\xd5\\x99\\x9fj\\xa1T\\xc3\t\\x1a\\xfbT\\xa8\\x98\\xa2\\x98\\xef\\x9b\r\\xe1=\\xaa!\\x01\\x08\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00x2g \\xe6bZ\\x10\\xa8\\xb7\\xb5\\x84\\?L\\xd4\\xd1\\xbf\\xe8\\xedX\\x857\\xd3\\xa8\\x18)\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 750, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 751, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags", "content": "0" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:31,030", "eid": 752, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7ffbc7b50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:31,030", "eid": 753, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 754, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 755, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot", "content": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 756, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\DllPath", "content": "C:\\Windows\\System32\\Windows.ApplicationModel.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 757, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 758, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot", "content": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 759, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 760, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 761, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 762, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 763, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,030", "eid": 764, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:31,030", "eid": 765, "data": { "file": "C:\\Windows\\System32\\Windows.ApplicationModel.dll", "pathtofile": null, "moduleaddress": "0x7ffbb3900000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:31,030", "eid": 766, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:31,061", "eid": 767, "data": { "file": "C:\\Windows\\System32\\bcryptprimitives.dll", "pathtofile": null, "moduleaddress": "0x7ffbc5750000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:31,061", "eid": 768, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:31,092", "eid": 769, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,092", "eid": 770, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,092", "eid": 771, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\(Default)", "content": "04c19204-10d9-450a-95c4-2910c8f72be3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,092", "eid": 772, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,092", "eid": 773, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,092", "eid": 774, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\DllPath", "content": "C:\\Windows\\System32\\CryptoWinRT.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,092", "eid": 775, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,092", "eid": 776, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,108", "eid": 777, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,108", "eid": 778, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,108", "eid": 779, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,108", "eid": 780, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,108", "eid": 781, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,108", "eid": 782, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:31,108", "eid": 783, "data": { "file": "C:\\Windows\\System32\\CryptoWinRT.dll", "pathtofile": null, "moduleaddress": "0x7ffb888b0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:31,108", "eid": 784, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,108", "eid": 785, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,108", "eid": 786, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,108", "eid": 787, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\DllPath", "content": "C:\\Windows\\System32\\CryptoWinRT.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,108", "eid": 788, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,108", "eid": 789, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,108", "eid": 790, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,108", "eid": 791, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,108", "eid": 792, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,108", "eid": 793, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,108", "eid": 794, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,108", "eid": 795, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,124", "eid": 796, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,124", "eid": 797, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,124", "eid": 798, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,124", "eid": 799, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,124", "eid": 800, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C5543B33-5C73-4DC5-9211-24077D3B06C5}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,124", "eid": 801, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,124", "eid": 802, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,124", "eid": 803, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,124", "eid": 804, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,124", "eid": 805, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,124", "eid": 806, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,139", "eid": 807, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\Expiration", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,155", "eid": 808, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,155", "eid": 809, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,155", "eid": 810, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\DllPath", "content": "C:\\Windows\\System32\\twinapi.appcore.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,155", "eid": 811, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,155", "eid": 812, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,155", "eid": 813, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,155", "eid": 814, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,155", "eid": 815, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,155", "eid": 816, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,155", "eid": 817, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:31,155", "eid": 818, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:31,170", "eid": 819, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,264", "eid": 820, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,264", "eid": 821, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,264", "eid": 822, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\DllPath", "content": "C:\\Windows\\System32\\WinTypes.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,264", "eid": 823, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,264", "eid": 824, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,264", "eid": 825, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,264", "eid": 826, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,264", "eid": 827, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,264", "eid": 828, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,264", "eid": 829, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,264", "eid": 830, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:33,264", "eid": 831, "data": { "file": "C:\\Windows\\System32\\WinTypes.dll", "pathtofile": null, "moduleaddress": "0x7ffbc1080000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:33,264", "eid": 832, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 833, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\XAML\\OneCoreTransformsEnabledByDefault", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:33,311", "eid": 834, "data": { "file": "oleaut32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 835, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 836, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 837, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\DllPath", "content": "C:\\Windows\\System32\\WinTypes.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 838, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 839, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 840, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 841, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 842, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 843, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 844, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 845, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 846, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 847, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 848, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\DllPath", "content": "C:\\Windows\\System32\\wpnapps.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 849, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Threading", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 850, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\TrustLevel", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 851, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 852, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateAsUser", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 853, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 854, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateInBrokerForMediumILContainer", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 855, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 856, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 857, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivationType", "content": "0" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:33,311", "eid": 858, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 859, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\DllPath", "content": "C:\\Windows\\System32\\TileDataRepository.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 860, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 861, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 862, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 863, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 864, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 865, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 866, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateOnHostFlags", "content": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:33,311", "eid": 867, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 868, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 869, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 870, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\DllPath", "content": "C:\\Windows\\System32\\biwinrt.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 871, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 872, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 873, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 874, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 875, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 876, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 877, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,311", "eid": 878, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:33,311", "eid": 879, "data": { "file": "C:\\Windows\\System32\\TileDataRepository.dll", "pathtofile": null, "moduleaddress": "0x7ffbb0cc0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:33,311", "eid": 880, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:33,327", "eid": 881, "data": { "file": "C:\\Windows\\System32\\biwinrt.dll", "pathtofile": null, "moduleaddress": "0x7ffbac310000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:33,327", "eid": 882, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:33,327", "eid": 883, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 884, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivationType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 885, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivationType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 886, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 887, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\Server", "content": "UserManager" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 888, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\DllPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 889, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\DllPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 890, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\Threading", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 891, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 892, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 893, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 894, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 895, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 896, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 897, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\IdentityType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 898, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 899, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\Permissions", "content": "\\x01\\x00\\x14\\x80d\\x00\\x00\\x00p\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x004\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 900, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 901, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 902, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 903, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExplicitPsmActivationType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 904, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExplicitPsmActivationType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 905, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{350E1244-4575-45EE-8595-0AA8C6506FC7}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 906, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}\\ProxyStubClsid32\\(Default)", "content": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 907, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}\\ProxyStubClsid32\\(Default)", "content": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 908, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 909, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 910, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 911, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 912, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 913, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 914, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 915, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)", "content": "Windows.System.User.ProxyStubFactory" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 916, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 917, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 918, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)", "content": "Windows.System.User.ProxyStubFactory" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 919, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)", "content": "C:\\Windows\\System32\\usermgrproxy.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 920, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 921, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)", "content": "C:\\Windows\\System32\\usermgrproxy.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 922, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\AppID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 923, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\AppID", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:33,327", "eid": 924, "data": { "file": "C:\\Windows\\System32\\usermgrproxy.dll", "pathtofile": null, "moduleaddress": "0x7ffbbdcb0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:33,327", "eid": 925, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 926, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{100EB64B-B24C-4C38-8964-720D926D05A4}\\ProxyStubClsid32\\(Default)", "content": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,327", "eid": 927, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{100EB64B-B24C-4C38-8964-720D926D05A4}\\ProxyStubClsid32\\(Default)", "content": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 928, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}\\ProxyStubClsid32\\(Default)", "content": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 929, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 930, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 931, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\DllPath", "content": "C:\\Windows\\System32\\WinTypes.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 932, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 933, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 934, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 935, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 936, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 937, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 938, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 939, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 940, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 941, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 942, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\DllPath", "content": "C:\\Windows\\System32\\WinTypes.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 943, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 944, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 945, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 946, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 947, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 948, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 949, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 950, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 951, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 952, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\DllPath", "content": "C:\\Windows\\System32\\WinTypes.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 953, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 954, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 955, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 956, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 957, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 958, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 959, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{b3f72108-5c5c-469b-a5e5-3f64d2a39b01}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 960, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivationType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 961, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 962, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 963, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 964, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 965, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 966, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,342", "eid": 967, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,358", "eid": 968, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{d81e96f1-a89c-417e-9335-59531026309d}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,358", "eid": 969, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{d81e96f1-a89c-417e-9335-59531026309d}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,358", "eid": 970, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bed20a5-6dee-4297-b976-3b30df69a7aa}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,358", "eid": 971, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bed20a5-6dee-4297-b976-3b30df69a7aa}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,358", "eid": 972, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7f290da0-75e3-5885-898d-1f5b1ed47ed2}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,358", "eid": 973, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7f290da0-75e3-5885-898d-1f5b1ed47ed2}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,358", "eid": 974, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9ed07b24-36fd-543b-948e-b01fe5814b49}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,358", "eid": 975, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{efe869fc-5841-55f1-aa56-82c7219aaa09}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,358", "eid": 976, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{efe869fc-5841-55f1-aa56-82c7219aaa09}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,374", "eid": 977, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,374", "eid": 978, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,374", "eid": 979, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,374", "eid": 980, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:33,374", "eid": 981, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 23:34:33,374", "eid": 982, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,389", "eid": 983, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,389", "eid": 984, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,389", "eid": 985, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\DllPath", "content": "C:\\Windows\\System32\\wpnapps.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,389", "eid": 986, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,389", "eid": 987, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\TrustLevel", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,389", "eid": 988, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,389", "eid": 989, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,389", "eid": 990, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,389", "eid": 991, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInBrokerForMediumILContainer", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,389", "eid": 992, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,389", "eid": 993, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,389", "eid": 994, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,389", "eid": 995, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,389", "eid": 996, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\DllPath", "content": "C:\\Windows\\System32\\windows.internal.shell.broker.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,389", "eid": 997, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,389", "eid": 998, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\TrustLevel", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,405", "eid": 999, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,405", "eid": 1000, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,405", "eid": 1001, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,405", "eid": 1002, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,405", "eid": 1003, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,405", "eid": 1004, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:33,452", "eid": 1005, "data": { "file": "gdi32.dll", "pathtofile": null, "moduleaddress": "0x7ffbc6d10000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:33,530", "eid": 1006, "data": { "file": "C:\\Windows\\System32\\windows.internal.shell.broker.dll", "pathtofile": null, "moduleaddress": "0x7ffbac200000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:33,530", "eid": 1007, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:33,577", "eid": 1008, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,608", "eid": 1009, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}\\ProxyStubClsid32\\(Default)", "content": "{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,608", "eid": 1010, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,608", "eid": 1011, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,608", "eid": 1012, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,608", "eid": 1013, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,608", "eid": 1014, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,608", "eid": 1015, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)", "content": "C:\\Windows\\System32\\PCShellCommonProxyStub.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,608", "eid": 1016, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,608", "eid": 1017, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,608", "eid": 1018, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,608", "eid": 1019, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,608", "eid": 1020, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,608", "eid": 1021, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,608", "eid": 1022, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)", "content": "C:\\Windows\\System32\\PCShellCommonProxyStub.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,608", "eid": 1023, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,608", "eid": 1024, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\AppID", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:33,608", "eid": 1025, "data": { "file": "C:\\Windows\\System32\\PCShellCommonProxyStub.dll", "pathtofile": null, "moduleaddress": "0x7ffbad3e0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:33,608", "eid": 1026, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:33,624", "eid": 1027, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,639", "eid": 1028, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,639", "eid": 1029, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,639", "eid": 1030, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\DllPath", "content": "C:\\Windows\\System32\\wpnapps.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,639", "eid": 1031, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Threading", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,639", "eid": 1032, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\TrustLevel", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,639", "eid": 1033, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,639", "eid": 1034, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,639", "eid": 1035, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,639", "eid": 1036, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInBrokerForMediumILContainer", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,639", "eid": 1037, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,639", "eid": 1038, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,639", "eid": 1039, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivationType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,639", "eid": 1040, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Server", "content": "UserManager" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,639", "eid": 1041, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\DllPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,639", "eid": 1042, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Threading", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,639", "eid": 1043, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,639", "eid": 1044, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,639", "eid": 1045, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,639", "eid": 1046, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,639", "eid": 1047, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,639", "eid": 1048, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,639", "eid": 1049, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Permissions", "content": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,639", "eid": 1050, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,655", "eid": 1051, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}\\ProxyStubClsid32\\(Default)", "content": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,655", "eid": 1052, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{e44ea1df-bb85-5a8c-bddc-c8e960c355c9}\\ProxyStubClsid32\\(Default)", "content": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,655", "eid": 1053, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8cbd762a-1222-5ee5-b745-489e7a42c6ec}\\ProxyStubClsid32\\(Default)", "content": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,686", "eid": 1054, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,686", "eid": 1055, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,686", "eid": 1056, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\DllPath", "content": "C:\\Windows\\System32\\TileDataRepository.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,686", "eid": 1057, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,686", "eid": 1058, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,686", "eid": 1059, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,686", "eid": 1060, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,686", "eid": 1061, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,686", "eid": 1062, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,686", "eid": 1063, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,686", "eid": 1064, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,686", "eid": 1065, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivationType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,686", "eid": 1066, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Server", "content": "StateRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,686", "eid": 1067, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\DllPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,686", "eid": 1068, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Threading", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,686", "eid": 1069, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,686", "eid": 1070, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,702", "eid": 1071, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,702", "eid": 1072, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,702", "eid": 1073, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,702", "eid": 1074, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,702", "eid": 1075, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,702", "eid": 1076, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{6d3bc882-23a4-4706-b8fa-fc7de2fc325d}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,702", "eid": 1077, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces\\DefaultStart", "content": "Windows.Internal.ApplicationModel.StartPinnableSurface" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,717", "eid": 1078, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,717", "eid": 1079, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,717", "eid": 1080, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\DllPath", "content": "C:\\Windows\\System32\\StartTileData.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,717", "eid": 1081, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,717", "eid": 1082, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\TrustLevel", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,717", "eid": 1083, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,717", "eid": 1084, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateAsUser", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,717", "eid": 1085, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,717", "eid": 1086, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,717", "eid": 1087, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,717", "eid": 1088, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:33,842", "eid": 1089, "data": { "file": "C:\\Windows\\System32\\StartTileData.dll", "pathtofile": null, "moduleaddress": "0x7ffbb1090000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:33,842", "eid": 1090, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,889", "eid": 1091, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\shellExperience", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:33,920", "eid": 1092, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:33,936", "eid": 1093, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,967", "eid": 1094, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces\\DefaultStart", "content": "Windows.Internal.ApplicationModel.StartPinnableSurface" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:33,983", "eid": 1095, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\shellExperience", "content": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:33,983", "eid": 1096, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:33,983", "eid": 1097, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:33,983", "eid": 1098, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 23:34:33,983", "eid": 1099, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:33,983", "eid": 1100, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 23:34:33,999", "eid": 1101, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 23:34:33,999", "eid": 1102, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,014", "eid": 1103, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,014", "eid": 1104, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,014", "eid": 1105, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\DllPath", "content": "C:\\Windows\\System32\\Windows.Storage.ApplicationData.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,014", "eid": 1106, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Threading", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,014", "eid": 1107, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,014", "eid": 1108, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,014", "eid": 1109, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,014", "eid": 1110, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,014", "eid": 1111, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,014", "eid": 1112, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,014", "eid": 1113, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:34,014", "eid": 1114, "data": { "file": "C:\\Windows\\System32\\Windows.Storage.ApplicationData.dll", "pathtofile": null, "moduleaddress": "0x7ffbac570000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:34,014", "eid": 1115, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,030", "eid": 1116, "data": { "regkey": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\SystemAppData\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\PSR\\WnfStateName", "content": "\\xe5\\xd0\\xbd\\xa3mN\\xc6A" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,030", "eid": 1117, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,030", "eid": 1118, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData", "content": "%USERPROFILE%\\AppData\\Local" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,030", "eid": 1119, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,030", "eid": 1120, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": "C:\\Users\\admin" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,045", "eid": 1121, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesMyComputer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,045", "eid": 1122, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesRecycleBin", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:34,045", "eid": 1123, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,045", "eid": 1124, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,045", "eid": 1125, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSetFolders", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,045", "eid": 1126, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoInternetIcon", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,045", "eid": 1127, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,045", "eid": 1128, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,045", "eid": 1129, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoCommonGroups", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,045", "eid": 1130, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\Attributes", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,045", "eid": 1131, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\CallForAttributes", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,045", "eid": 1132, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\RestrictedAttributes", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,045", "eid": 1133, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\FolderValueFlags", "content": "1581568" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,045", "eid": 1134, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,045", "eid": 1135, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,045", "eid": 1136, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:34,045", "eid": 1137, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:34,077", "eid": 1138, "data": { "file": "C:\\Windows\\System32\\mssprxy.dll", "pathtofile": null, "moduleaddress": "0x7ffbb55b0000" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,077", "eid": 1139, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}\\ProxyStubClsid32\\(Default)", "content": "{A5EBA07A-DAE8-4d15-B12F-728EFD8A9866}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,077", "eid": 1140, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}\\ProxyStubClsid32\\(Default)", "content": "{A5EBA07A-DAE8-4d15-B12F-728EFD8A9866}" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:34,077", "eid": 1141, "data": { "file": "C:\\Windows\\System32\\propsys.dll", "pathtofile": null, "moduleaddress": "0x7ffbc0db0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:34,077", "eid": 1142, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,077", "eid": 1143, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,077", "eid": 1144, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData", "content": "%USERPROFILE%\\AppData\\Local" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,077", "eid": 1145, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,077", "eid": 1146, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": "C:\\Users\\admin" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,092", "eid": 1147, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,092", "eid": 1148, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot", "content": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,092", "eid": 1149, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,092", "eid": 1150, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot", "content": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,092", "eid": 1151, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Data", "content": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xbaA\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00t6L\\xb3\\x1f\\x00\\x00\\x00\\x04@\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x003\\x003\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1152, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1153, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1154, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DontShowSuperHidden", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1155, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1156, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState", "content": "$\\x00\\x00\\x004(\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1157, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoWebView", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1158, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\ClassicShell", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1159, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\SeparateProcess", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1160, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoNetCrawling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1161, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1162, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowCompColor", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1163, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1164, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\DontPrettyPath", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1165, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowInfoTip", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1166, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideIcons", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1167, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\MapNetDrvBtn", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1168, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\WebView", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1169, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Filter", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1170, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1171, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\SeparateProcess", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1172, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\NoNetCrawling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1173, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\AutoCheckSelect", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1174, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\IconsOnly", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1175, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowTypeOverlay", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1176, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowStatusBar", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1177, "data": { "regkey": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\DocObject", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1178, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\DocObject", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1179, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1180, "data": { "regkey": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\BrowseInPlace", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1181, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\BrowseInPlace", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1182, "data": { "regkey": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\IsShortcut", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1183, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\IsShortcut", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1184, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Data", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1185, "data": { "regkey": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\AlwaysShowExt", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1186, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Data", "content": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xba\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00R\\xbd\\xbb\\x88\\x1e\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x001\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1187, "data": { "regkey": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\NeverShowExt", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1188, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\NeverShowExt", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1189, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Generation", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1190, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Data", "content": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xbaA\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00t6L\\xb3\\x1f\\x00\\x00\\x00\\x04@\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x003\\x003\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1191, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Category", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1192, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParentFolder", "content": "{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1193, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\RelativePath", "content": "Microsoft\\Windows\\Start Menu" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1194, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParsingName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1195, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InfoTip", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1196, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalizedName", "content": "@%SystemRoot%\\system32\\shell32.dll,-21786" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1197, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Security", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1198, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResource", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1199, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalRedirectOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1200, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Roamable", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1201, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PreCreate", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1202, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PublishExpandedPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1203, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\DefinitionFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1204, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Attributes", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1205, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\FolderTypeID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1206, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InitFolderHandler", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1207, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Start Menu", "content": "%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1208, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Category", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1209, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Name", "content": "Common Start Menu" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1210, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParentFolder", "content": "{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1211, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Description", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1212, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\RelativePath", "content": "Microsoft\\Windows\\Start Menu" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,108", "eid": 1213, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParsingName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1214, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InfoTip", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1215, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalizedName", "content": "@%SystemRoot%\\system32\\shell32.dll,-21786" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1216, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Icon", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1217, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Security", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1218, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResource", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1219, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResourceType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1220, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalRedirectOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1221, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Roamable", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1222, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PreCreate", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1223, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Stream", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1224, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PublishExpandedPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1225, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\DefinitionFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1226, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Attributes", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1227, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\FolderTypeID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1228, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InitFolderHandler", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1229, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Start Menu", "content": "%ProgramData%\\Microsoft\\Windows\\Start Menu" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1230, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Category", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1231, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Name", "content": "Recent" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1232, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParentFolder", "content": "{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1233, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Description", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1234, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\RelativePath", "content": "Microsoft\\Windows\\Recent" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1235, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParsingName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1236, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InfoTip", "content": "@shell32,dll,-12692" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1237, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalizedName", "content": "@%SystemRoot%\\system32\\shell32.dll,-21797" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1238, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Icon", "content": "%SystemRoot%\\system32\\imageres.dll,-117" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1239, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Security", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1240, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResource", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1241, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResourceType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1242, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalRedirectOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1243, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Roamable", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1244, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PreCreate", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1245, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Stream", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1246, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PublishExpandedPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1247, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\DefinitionFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1248, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Attributes", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1249, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\FolderTypeID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1250, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InitFolderHandler", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1251, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Recent", "content": "%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Recent" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1252, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Category", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1253, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Name", "content": "Windows" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1254, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParentFolder", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1255, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Description", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1256, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\RelativePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1257, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParsingName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1258, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InfoTip", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1259, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalizedName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1260, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Icon", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1261, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Security", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1262, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResource", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1263, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResourceType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1264, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalRedirectOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1265, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Roamable", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1266, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PreCreate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1267, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Stream", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1268, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PublishExpandedPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1269, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\DefinitionFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1270, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Attributes", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1271, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\FolderTypeID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1272, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InitFolderHandler", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1273, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Category", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1274, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Name", "content": "System" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1275, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParentFolder", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1276, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Description", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1277, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\RelativePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1278, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParsingName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1279, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InfoTip", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1280, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalizedName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1281, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Icon", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1282, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Security", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1283, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResource", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1284, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResourceType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1285, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalRedirectOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1286, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Roamable", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1287, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PreCreate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1288, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Stream", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1289, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PublishExpandedPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1290, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\DefinitionFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1291, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Attributes", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1292, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\FolderTypeID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1293, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InitFolderHandler", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1294, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Category", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1295, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Name", "content": "Personal" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1296, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParentFolder", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1297, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Description", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1298, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\RelativePath", "content": "Documents" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1299, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParsingName", "content": "shell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\::{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1300, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InfoTip", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1301, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalizedName", "content": "@%SystemRoot%\\system32\\windows.storage.dll,-21770" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1302, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Icon", "content": "%SystemRoot%\\system32\\imageres.dll,-112" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1303, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Security", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1304, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResource", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1305, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResourceType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1306, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalRedirectOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1307, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Roamable", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1308, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PreCreate", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1309, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Stream", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1310, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PublishExpandedPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1311, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\DefinitionFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1312, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Attributes", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1313, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\FolderTypeID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1314, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InitFolderHandler", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1315, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Personal", "content": "%USERPROFILE%\\Documents" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1316, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Category", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1317, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Name", "content": "Fonts" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1318, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParentFolder", "content": "{F38BF404-1D43-42F2-9305-67DE0B28FC23}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1319, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Description", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1320, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\RelativePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1321, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParsingName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,124", "eid": 1322, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InfoTip", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,139", "eid": 1323, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalizedName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,139", "eid": 1324, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Icon", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,139", "eid": 1325, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Security", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,139", "eid": 1326, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResource", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,139", "eid": 1327, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResourceType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,139", "eid": 1328, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalRedirectOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,139", "eid": 1329, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Roamable", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,139", "eid": 1330, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PreCreate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,139", "eid": 1331, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Stream", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,139", "eid": 1332, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PublishExpandedPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,139", "eid": 1333, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\DefinitionFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,139", "eid": 1334, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Attributes", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,139", "eid": 1335, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\FolderTypeID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,139", "eid": 1336, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InitFolderHandler", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:34:34,139", "eid": 1337, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}\\DriveMask", "content": "32" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:34,139", "eid": 1338, "data": { "file": "C:\\Windows\\System32\\windows.storage.dll", "pathtofile": null, "moduleaddress": "0x7ffbc3310000" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:34,139", "eid": 1339, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 23:34:34,139", "eid": 1340, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:34,139", "eid": 1341, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:34,155", "eid": 1342, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:38,999", "eid": 1343, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 23:34:38,999", "eid": 1344, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:39,155", "eid": 1345, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 23:34:39,155", "eid": 1346, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:44,170", "eid": 1347, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "read", "object": "file", "timestamp": "2026-05-28 23:34:44,170", "eid": 1348, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:44,170", "eid": 1349, "data": { "file": "oleaut32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:44,170", "eid": 1350, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:44,170", "eid": 1351, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "write", "object": "file", "timestamp": "2026-05-28 23:34:44,170", "eid": 1352, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.5704.6212.3447842024212442791" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:34:58,420", "eid": 1353, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7ffbc4230000" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-28 23:34:58,795", "eid": 1354, "data": { "file": "\"C:\\Windows\\SystemApps\\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\\CHXSmartScreen.exe\" -ServerName:App.AppXk7vvv12h4qrkhkbvf6j86ja45mzj5km9.mca" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:00,561", "eid": 1355, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7ffbc4230000" } }, { "event": "start", "object": "service", "timestamp": "2026-05-28 23:35:03,639", "eid": 1356, "data": { "service": "MicrosoftEdgeElevationService" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-28 23:35:04,561", "eid": 1357, "data": { "file": "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-28 23:35:09,342", "eid": 1358, "data": { "file": "\"C:\\Windows\\SystemApps\\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\\CHXSmartScreen.exe\" -ServerName:App.AppXk7vvv12h4qrkhkbvf6j86ja45mzj5km9.mca" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,656", "eid": 1359, "data": { "file": "C:\\Windows\\system32\\rpcss.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1360, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1361, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1362, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1363, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,671", "eid": 1364, "data": { "file": "combase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1365, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1366, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1367, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": "Thumbnail Cache Out of Proc Server" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1368, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalService", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1369, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1370, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate", "content": "" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1371, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RunAs", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1372, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateAtStorage", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1373, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ROTFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1374, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppIDFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1375, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\MGOTFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1376, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProcessMitigationPolicy", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1377, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LaunchPermission", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1378, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyAuthenticationLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1379, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyImpersonationLevel", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1380, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AuthenticationLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1381, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RemoteServerName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1382, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\SRPTrustLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1383, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\PreferredServerBitness", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1384, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LoadUserSettings", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1385, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProtectionLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1386, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1387, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,671", "eid": 1388, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1389, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1390, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AuthenticationLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1391, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1392, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AccessPermission", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1393, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\DefaultAccessPermission", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,671", "eid": 1394, "data": { "file": "C:\\Windows\\system32\\rpcss.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1395, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "content": "{00000320-0000-0000-C000-000000000046}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,671", "eid": 1396, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\Extensions\\NdrOleExtDLL", "content": "combase.dll" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,671", "eid": 1397, "data": { "file": "combase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,671", "eid": 1398, "data": { "file": "combase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,687", "eid": 1399, "data": { "file": "combase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,687", "eid": 1400, "data": { "file": "C:\\Windows\\System32\\uxtheme.dll", "pathtofile": null, "moduleaddress": "0x7ffbc2bf0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,687", "eid": 1401, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,687", "eid": 1402, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,687", "eid": 1403, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,687", "eid": 1404, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,687", "eid": 1405, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": "Thumbnail Cache Class Factory for Out of Proc Server" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,687", "eid": 1406, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,687", "eid": 1407, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,687", "eid": 1408, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)", "content": "C:\\Windows\\System32\\thumbcache.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,687", "eid": 1409, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\ThreadingModel", "content": "Apartment" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,687", "eid": 1410, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,687", "eid": 1411, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\GipActivityBypass", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,687", "eid": 1412, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,687", "eid": 1413, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,687", "eid": 1414, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": "Thumbnail Cache Class Factory for Out of Proc Server" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,687", "eid": 1415, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,687", "eid": 1416, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,687", "eid": 1417, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)", "content": "C:\\Windows\\System32\\thumbcache.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,687", "eid": 1418, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\ThreadingModel", "content": "Apartment" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,687", "eid": 1419, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppID", "content": "{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,687", "eid": 1420, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,687", "eid": 1421, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": "Thumbnail Cache Out of Proc Server" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,687", "eid": 1422, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalService", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,687", "eid": 1423, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,687", "eid": 1424, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate", "content": "" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,687", "eid": 1425, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RunAs", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,687", "eid": 1426, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateAtStorage", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,687", "eid": 1427, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ROTFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,687", "eid": 1428, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppIDFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,687", "eid": 1429, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\MGOTFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,687", "eid": 1430, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProcessMitigationPolicy", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,687", "eid": 1431, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LaunchPermission", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,703", "eid": 1432, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyAuthenticationLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,703", "eid": 1433, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyImpersonationLevel", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,703", "eid": 1434, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AuthenticationLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,703", "eid": 1435, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RemoteServerName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,703", "eid": 1436, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\SRPTrustLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,703", "eid": 1437, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\PreferredServerBitness", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,703", "eid": 1438, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LoadUserSettings", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,703", "eid": 1439, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProtectionLevel", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,703", "eid": 1440, "data": { "file": "C:\\Windows\\System32\\thumbcache.dll", "pathtofile": null, "moduleaddress": "0x7ffbb0100000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,703", "eid": 1441, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,703", "eid": 1442, "data": { "file": "combase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,703", "eid": 1443, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{75121952-e0d0-43e5-9380-1d80483acf72}\\ProxyStubClsid32\\(Default)", "content": "{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,703", "eid": 1444, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,703", "eid": 1445, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,703", "eid": 1446, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,703", "eid": 1447, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,703", "eid": 1448, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,703", "eid": 1449, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)", "content": "%SystemRoot%\\system32\\propsys.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,703", "eid": 1450, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,703", "eid": 1451, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,703", "eid": 1452, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,703", "eid": 1453, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,703", "eid": 1454, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,703", "eid": 1455, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,703", "eid": 1456, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)", "content": "%SystemRoot%\\system32\\propsys.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,703", "eid": 1457, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:04,703", "eid": 1458, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\AppID", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,703", "eid": 1459, "data": { "file": "C:\\Windows\\System32\\propsys.dll", "pathtofile": null, "moduleaddress": "0x7ffbc0db0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:04,703", "eid": 1460, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:07,359", "eid": 1461, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:07,359", "eid": 1462, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:07,359", "eid": 1463, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": "Thumbnail Cache Class Factory for Out of Proc Server" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:07,359", "eid": 1464, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:07,359", "eid": 1465, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:07,359", "eid": 1466, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)", "content": "C:\\Windows\\System32\\thumbcache.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:07,359", "eid": 1467, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\ThreadingModel", "content": "Apartment" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:07,359", "eid": 1468, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:07,359", "eid": 1469, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:07,359", "eid": 1470, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": "Thumbnail Cache Class Factory for Out of Proc Server" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:07,359", "eid": 1471, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:07,359", "eid": 1472, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:07,359", "eid": 1473, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)", "content": "C:\\Windows\\System32\\thumbcache.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-28 23:35:07,359", "eid": 1474, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\ThreadingModel", "content": "Apartment" } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:12,406", "eid": 1475, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:12,406", "eid": 1476, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:12,406", "eid": 1477, "data": { "file": "oleaut32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-28 23:35:12,406", "eid": 1478, "data": { "file": "oleaut32.dll", "pathtofile": null, "moduleaddress": null } } ], "encryptedbuffers": [], "network_map": { "endpoint_map": {}, "http_host_map": {}, "dns_intents": {}, "http_requests": [], "winhttp_sessions": [], "com_activations": [] } }, "debug": { "log": "2026-05-28 19:33:25,382 [root] INFO: Date set to: 20260528T19:34:15, timeout set to: 200\n2026-05-28 19:34:15,004 [root] DEBUG: Starting analyzer from: C:\\hsngo5k_\n2026-05-28 19:34:15,005 [root] DEBUG: Storing results at: C:\\nhdjfgMY\n2026-05-28 19:34:15,005 [root] DEBUG: Pipe server name: \\\\.\\PIPE\\KLuGAxLLsj\n2026-05-28 19:34:15,005 [root] DEBUG: Python path: C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64\n2026-05-28 19:34:15,005 [root] INFO: analysis running as an admin\n2026-05-28 19:34:15,005 [root] INFO: analysis package specified: \"edge\"\n2026-05-28 19:34:15,005 [root] DEBUG: importing analysis package module: \"modules.packages.edge\"...\n2026-05-28 19:34:15,007 [root] DEBUG: imported analysis package \"edge\"\n2026-05-28 19:34:15,007 [root] DEBUG: initializing analysis package \"edge\"...\n2026-05-28 19:34:15,007 [root] DEBUG: New location of moved file: https://badoomovies.com/download/BadooMovies.exe\n2026-05-28 19:34:15,007 [root] INFO: Analyzer: Package modules.packages.edge does not specify a dll option\n2026-05-28 19:34:15,008 [root] INFO: Analyzer: Package modules.packages.edge does not specify a dll_64 option\n2026-05-28 19:34:15,008 [root] INFO: Analyzer: Package modules.packages.edge does not specify a loader option\n2026-05-28 19:34:15,008 [root] INFO: Analyzer: Package modules.packages.edge does not specify a loader_64 option\n2026-05-28 19:34:15,021 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.browser\"\n2026-05-28 19:34:15,042 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.digisig\"\n2026-05-28 19:34:15,052 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.disguise\"\n2026-05-28 19:34:15,057 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.human\"\n2026-05-28 19:34:15,059 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'\n2026-05-28 19:34:15,060 [lib.api.screenshot] ERROR: No module named 'PIL'\n2026-05-28 19:34:15,060 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.screenshots\"\n2026-05-28 19:34:15,061 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.tlsdump\"\n2026-05-28 19:34:15,061 [root] DEBUG: Initialized auxiliary module \"Browser\"\n2026-05-28 19:34:15,061 [root] DEBUG: attempting to configure 'Browser' from data\n2026-05-28 19:34:15,062 [root] DEBUG: module Browser does not support data configuration, ignoring\n2026-05-28 19:34:15,062 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.browser\"...\n2026-05-28 19:34:15,063 [root] DEBUG: Started auxiliary module modules.auxiliary.browser\n2026-05-28 19:34:15,063 [root] DEBUG: Initialized auxiliary module \"DigiSig\"\n2026-05-28 19:34:15,063 [root] DEBUG: attempting to configure 'DigiSig' from data\n2026-05-28 19:34:15,064 [root] DEBUG: module DigiSig does not support data configuration, ignoring\n2026-05-28 19:34:15,064 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.digisig\"...\n2026-05-28 19:34:15,064 [modules.auxiliary.digisig] DEBUG: Skipping authenticode validation, analysis is not a file\n2026-05-28 19:34:15,064 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig\n2026-05-28 19:34:15,064 [root] DEBUG: Initialized auxiliary module \"Disguise\"\n2026-05-28 19:34:15,064 [root] DEBUG: attempting to configure 'Disguise' from data\n2026-05-28 19:34:15,065 [root] DEBUG: module Disguise does not support data configuration, ignoring\n2026-05-28 19:34:15,065 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.disguise\"...\n2026-05-28 19:34:15,067 [modules.auxiliary.disguise] INFO: Launched background process notepad.exe hidden (PID: 680)\n2026-05-28 19:34:15,067 [modules.auxiliary.disguise] INFO: Disguising GUID to b9707053-9b47-434e-80d6-fdf06c9a7deb\n2026-05-28 19:34:15,067 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise\n2026-05-28 19:34:15,068 [root] DEBUG: Initialized auxiliary module \"Human\"\n2026-05-28 19:34:15,068 [root] DEBUG: attempting to configure 'Human' from data\n2026-05-28 19:34:15,068 [root] DEBUG: module Human does not support data configuration, ignoring\n2026-05-28 19:34:15,068 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.human\"...\n2026-05-28 19:34:15,069 [root] DEBUG: Started auxiliary module modules.auxiliary.human\n2026-05-28 19:34:15,069 [root] DEBUG: Initialized auxiliary module \"Screenshots\"\n2026-05-28 19:34:15,069 [root] DEBUG: attempting to configure 'Screenshots' from data\n2026-05-28 19:34:15,070 [root] DEBUG: module Screenshots does not support data configuration, ignoring\n2026-05-28 19:34:15,070 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.screenshots\"...\n2026-05-28 19:34:15,070 [modules.auxiliary.screenshots] WARNING: Python Image Library is not installed, screenshots are disabled\n2026-05-28 19:34:15,070 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots\n2026-05-28 19:34:15,070 [root] DEBUG: Initialized auxiliary module \"TLSDumpMasterSecrets\"\n2026-05-28 19:34:15,070 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data\n2026-05-28 19:34:15,071 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring\n2026-05-28 19:34:15,071 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.tlsdump\"...\n2026-05-28 19:34:15,072 [modules.auxiliary.tlsdump] WARNING: Unable to find lsass.exe process\n2026-05-28 19:34:15,073 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump\n2026-05-28 19:34:15,073 [root] INFO: Interactive mode enabled - injecting into explorer shell\n2026-05-28 19:34:15,096 [lib.api.process] INFO: Monitor config for process 4692: C:\\hsngo5k_\\dll\\4692.ini\n2026-05-28 19:34:15,097 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 19:34:15,099 [lib.api.process] INFO: 64-bit DLL to inject is C:\\hsngo5k_\\dll\\gIlsNlf.dll, loader C:\\hsngo5k_\\bin\\vouhCgRr.exe\n2026-05-28 19:34:15,189 [root] DEBUG: Loader: Injecting process 4692 with C:\\hsngo5k_\\dll\\gIlsNlf.dll.\n2026-05-28 19:34:15,364 [root] DEBUG: 4692: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-28 19:34:15,365 [root] DEBUG: 4692: Disabling sleep skipping.\n2026-05-28 19:34:15,365 [root] DEBUG: 4692: Interactive desktop enabled.\n2026-05-28 19:34:15,365 [root] DEBUG: 4692: Dropped file limit defaulting to 100.\n2026-05-28 19:34:15,366 [root] DEBUG: 4692: Interactive desktop - injecting Explorer Shell\n2026-05-28 19:34:15,370 [root] DEBUG: 4692: YaraInit: Compiled 44 rule files\n2026-05-28 19:34:15,371 [root] DEBUG: 4692: YaraInit: Compiled rules saved to file C:\\hsngo5k_\\data\\yara\\capemon.yac\n2026-05-28 19:34:15,473 [root] DEBUG: 4692: RtlInsertInvertedFunctionTable 0x00007FFBC7B6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFBC7CBD4F0\n2026-05-28 19:34:15,476 [root] DEBUG: 4692: YaraScan: Scanning 0x00007FF627610000, size 0x545316\n2026-05-28 19:34:15,545 [root] DEBUG: 4692: Monitor initialised: 64-bit capemon loaded in process 4692 at 0x00007FFB863A0000, thread 5576, image base 0x00007FF627610000, stack from 0x0000000010B51000-0x0000000010B60000\n2026-05-28 19:34:15,547 [root] DEBUG: 4692: Commandline: C:\\Windows\\Explorer.EXE\n2026-05-28 19:34:15,557 [root] DEBUG: 4692: Hooked 69 out of 69 functions\n2026-05-28 19:34:15,586 [root] DEBUG: 4692: Syscall hook installed, syscall logging level 1\n2026-05-28 19:34:15,599 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.\n2026-05-28 19:34:15,600 [root] DEBUG: Successfully injected DLL C:\\hsngo5k_\\dll\\gIlsNlf.dll.\n2026-05-28 19:34:15,601 [lib.api.process] INFO: Injected into 64-bit \n2026-05-28 19:34:18,791 [root] DEBUG: 4692: caller_dispatch: Added region at 0x00007FF627610000 to tracked regions list (ntdll::NtDuplicateObject returns to 0x00007FF62762C161, thread 4696).\n2026-05-28 19:34:18,792 [root] DEBUG: 4692: YaraScan: Scanning 0x00007FF627610000, size 0x545316\n2026-05-28 19:34:18,830 [root] DEBUG: 4692: ProcessImageBase: Main module image at 0x00007FF627610000 unmodified (entropy change 0.000000e+00)\n2026-05-28 19:34:20,246 [root] DEBUG: 4692: DLL loaded at 0x00007FFBB9D80000: C:\\Windows\\System32\\dlnashext (0x56000 bytes).\n2026-05-28 19:34:20,251 [root] DEBUG: 4692: DLL loaded at 0x00007FFB881F0000: C:\\Windows\\WinSxS\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.3636_none_91a19322cc8a92a3\\gdiplus (0x1a5000 bytes).\n2026-05-28 19:34:20,251 [root] DEBUG: 4692: DLL loaded at 0x00007FFBB4520000: C:\\Windows\\system32\\wpdshext (0xa1000 bytes).\n2026-05-28 19:34:20,296 [root] DEBUG: 4692: api-rate-cap: CoCreateInstance hook disabled due to rate\n2026-05-28 19:34:21,553 [root] DEBUG: 4692: DLL loaded at 0x00007FFBB5020000: C:\\Windows\\System32\\execmodelclient (0x63000 bytes).\n2026-05-28 19:34:21,569 [root] DEBUG: 4692: DLL loaded at 0x00007FFBBA650000: C:\\Windows\\SYSTEM32\\ploptin (0x13000 bytes).\n2026-05-28 19:34:21,575 [root] DEBUG: 4692: DLL loaded at 0x00007FFBBA650000: C:\\Windows\\SYSTEM32\\ploptin (0x13000 bytes).\n2026-05-28 19:34:21,580 [root] DEBUG: 4692: DLL loaded at 0x00007FFBBA650000: C:\\Windows\\SYSTEM32\\ploptin (0x13000 bytes).\n2026-05-28 19:34:22,702 [root] DEBUG: 4692: DLL loaded at 0x00007FFBAC200000: C:\\Windows\\System32\\windows.internal.shell.broker (0xdd000 bytes).\n2026-05-28 19:34:22,732 [root] INFO: Restarting WMI Service\n2026-05-28 19:34:24,767 [root] DEBUG: package modules.packages.edge does not support configure, ignoring\n2026-05-28 19:34:24,767 [root] WARNING: configuration error for package modules.packages.edge: error importing data.packages.edge: No module named 'data.packages'\n2026-05-28 19:34:24,768 [lib.core.compound] INFO: C:\\Users\\admin\\AppData\\Local\\Temp already exists, skipping creation\n2026-05-28 19:34:24,770 [lib.api.process] INFO: Successfully executed process from path \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" with arguments \"\"https://badoomovies.com/download/BadooMovies.exe\"\" with pid 5704\n2026-05-28 19:34:24,770 [lib.api.process] INFO: Monitor config for process 5704: C:\\hsngo5k_\\dll\\5704.ini\n2026-05-28 19:34:24,771 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 19:34:24,772 [lib.api.process] INFO: 64-bit DLL to inject is C:\\hsngo5k_\\dll\\gIlsNlf.dll, loader C:\\hsngo5k_\\bin\\vouhCgRr.exe\n2026-05-28 19:34:24,776 [root] DEBUG: Loader: Injecting process 5704 (thread 3916) with C:\\hsngo5k_\\dll\\gIlsNlf.dll.\n2026-05-28 19:34:24,777 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 19:34:24,777 [root] DEBUG: Successfully injected DLL C:\\hsngo5k_\\dll\\gIlsNlf.dll.\n2026-05-28 19:34:24,778 [lib.api.process] INFO: Injected into 64-bit \n2026-05-28 19:34:26,786 [lib.api.process] INFO: Successfully resumed process with pid 5704\n2026-05-28 19:34:26,837 [root] DEBUG: 5704: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-28 19:34:26,838 [root] DEBUG: 5704: Disabling sleep skipping.\n2026-05-28 19:34:26,838 [root] DEBUG: 5704: Interactive desktop enabled.\n2026-05-28 19:34:26,839 [root] DEBUG: 5704: Dropped file limit defaulting to 100.\n2026-05-28 19:34:26,847 [root] DEBUG: 5704: Edge-specific hook-set enabled.\n2026-05-28 19:34:26,850 [root] DEBUG: 5704: YaraInit: Compiled rules loaded from existing file C:\\hsngo5k_\\data\\yara\\capemon.yac\n2026-05-28 19:34:26,861 [root] DEBUG: 5704: RtlInsertInvertedFunctionTable 0x00007FFBC7B6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFBC7CBD4F0\n2026-05-28 19:34:26,862 [root] DEBUG: 5704: Monitor initialised: 64-bit capemon loaded in process 5704 at 0x00007FFB863A0000, thread 3916, image base 0x00007FF66C3B0000, stack from 0x00000095AB5F4000-0x00000095AB600000\n2026-05-28 19:34:26,862 [root] DEBUG: 5704: Commandline: \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" \"https://badoomovies.com/download/BadooMovies.exe\"\n2026-05-28 19:34:26,871 [root] DEBUG: 5704: Hooked 2 out of 2 functions\n2026-05-28 19:34:27,026 [root] DEBUG: 5704: Syscall hook installed, syscall logging level 1\n2026-05-28 19:34:27,031 [root] DEBUG: 5704: RestoreHeaders: Restored original import table.\n2026-05-28 19:34:27,032 [root] INFO: Loaded monitor into process with pid 5704\n2026-05-28 19:34:27,034 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC5750000: C:\\Windows\\System32\\bcryptprimitives (0x82000 bytes).\n2026-05-28 19:34:27,039 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB4F50000: C:\\Windows\\SYSTEM32\\version (0xa000 bytes).\n2026-05-28 19:34:27,040 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC5C20000: C:\\Windows\\System32\\shcore (0xad000 bytes).\n2026-05-28 19:34:27,041 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC4BF0000: C:\\Windows\\SYSTEM32\\Wldp (0x2d000 bytes).\n2026-05-28 19:34:27,042 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC3310000: C:\\Windows\\SYSTEM32\\windows.storage (0x79b000 bytes).\n2026-05-28 19:34:27,042 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC5C20000: C:\\Windows\\System32\\SHCORE (0xad000 bytes).\n2026-05-28 19:34:27,043 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC4350000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-28 19:34:27,289 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB35A0000: C:\\Windows\\SYSTEM32\\WINMM (0x27000 bytes).\n2026-05-28 19:34:27,290 [root] DEBUG: 5704: DLL loaded at 0x00007FFB71750000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge (0x136be000 bytes).\n2026-05-28 19:34:27,296 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB33A0000: C:\\Windows\\SYSTEM32\\KBDUS (0x9000 bytes).\n2026-05-28 19:34:27,300 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC2BF0000: C:\\Windows\\system32\\uxtheme (0x9e000 bytes).\n2026-05-28 19:34:27,306 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC3110000: C:\\Windows\\SYSTEM32\\kernel.appcore (0x12000 bytes).\n2026-05-28 19:34:27,307 [root] DEBUG: 5704: CreateProcessHandler: Injection info set for new process 4136: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF66C3B0000\n2026-05-28 19:34:27,307 [root] DEBUG: 5704: ProcessMessage: Skipping monitoring process 4136\n2026-05-28 19:34:27,308 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC7A60000: C:\\Windows\\System32\\clbcatq (0xa9000 bytes).\n2026-05-28 19:34:27,308 [root] DEBUG: 5704: ProcessMessage: Skipping monitoring process 4136\n2026-05-28 19:34:27,309 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB1AA0000: C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings (0x16000 bytes).\n2026-05-28 19:34:27,310 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC42C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-28 19:34:27,310 [root] DEBUG: 5704: DLL loaded at 0x00007FFBBF330000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-28 19:34:27,316 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC5120000: C:\\Windows\\SYSTEM32\\USERENV (0x2e000 bytes).\n2026-05-28 19:34:27,318 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC3AC0000: C:\\Windows\\SYSTEM32\\gpapi (0x23000 bytes).\n2026-05-28 19:34:27,319 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC4390000: C:\\Windows\\SYSTEM32\\wkscli (0x19000 bytes).\n2026-05-28 19:34:27,321 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC4700000: C:\\Windows\\SYSTEM32\\netutils (0xc000 bytes).\n2026-05-28 19:34:27,322 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC42C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-28 19:34:27,322 [root] DEBUG: 5704: DLL loaded at 0x00007FFBAD7D0000: C:\\Windows\\SYSTEM32\\MDMRegistration (0x68000 bytes).\n2026-05-28 19:34:27,324 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC4FE0000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-28 19:34:27,325 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC4AF0000: C:\\Windows\\SYSTEM32\\CRYPTSP (0x18000 bytes).\n2026-05-28 19:34:27,325 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC4C60000: C:\\Windows\\SYSTEM32\\ncrypt (0x27000 bytes).\n2026-05-28 19:34:27,326 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC6800000: C:\\Windows\\System32\\imagehlp (0x1d000 bytes).\n2026-05-28 19:34:27,326 [root] DEBUG: 5704: DLL loaded at 0x00007FFBBCE20000: C:\\Windows\\SYSTEM32\\tbs (0x1b000 bytes).\n2026-05-28 19:34:27,328 [root] DEBUG: 5704: DLL loaded at 0x00007FFBAD720000: C:\\Windows\\SYSTEM32\\DMCmnUtils (0x7c000 bytes).\n2026-05-28 19:34:27,329 [root] DEBUG: 5704: DLL loaded at 0x00007FFBAD950000: C:\\Windows\\SYSTEM32\\omadmapi (0x3a000 bytes).\n2026-05-28 19:34:27,330 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC4FC0000: C:\\Windows\\SYSTEM32\\UMPDC (0x12000 bytes).\n2026-05-28 19:34:27,330 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC4C20000: C:\\Windows\\SYSTEM32\\NTASN1 (0x3b000 bytes).\n2026-05-28 19:34:27,332 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB3170000: C:\\Windows\\SYSTEM32\\netapi32 (0x19000 bytes).\n2026-05-28 19:34:27,332 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC42C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-28 19:34:27,333 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC4AF0000: C:\\Windows\\SYSTEM32\\cryptsp (0x18000 bytes).\n2026-05-28 19:34:27,333 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC0F30000: C:\\Windows\\SYSTEM32\\DSREG (0x141000 bytes).\n2026-05-28 19:34:27,335 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC5160000: C:\\Windows\\SYSTEM32\\profapi (0x25000 bytes).\n2026-05-28 19:34:27,345 [root] DEBUG: 5704: DLL loaded at 0x00007FFBAD970000: C:\\Windows\\System32\\AssignedAccessRuntime (0x14000 bytes).\n2026-05-28 19:34:27,346 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC7690000: C:\\Windows\\System32\\MSCTF (0x114000 bytes).\n2026-05-28 19:34:27,347 [root] DEBUG: 5704: DLL loaded at 0x00007FFBBA6F0000: C:\\Windows\\System32\\SystemSettings.DataModel (0x74000 bytes).\n2026-05-28 19:34:27,348 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC4FE0000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-28 19:34:27,349 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC4FC0000: C:\\Windows\\SYSTEM32\\UMPDC (0x12000 bytes).\n2026-05-28 19:34:27,351 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB7F30000: C:\\Windows\\SYSTEM32\\DWrite (0x27f000 bytes).\n2026-05-28 19:34:27,353 [root] DEBUG: 5704: DLL loaded at 0x00007FFBBE780000: C:\\Windows\\System32\\OneCoreUAPCommonProxyStub (0x7d0000 bytes).\n2026-05-28 19:34:27,354 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB1750000: C:\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\\COMCTL32 (0x29a000 bytes).\n2026-05-28 19:34:27,356 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC4FB0000: C:\\Windows\\SYSTEM32\\DPAPI (0xa000 bytes).\n2026-05-28 19:34:27,357 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC45F0000: C:\\Windows\\SYSTEM32\\IPHLPAPI (0x3b000 bytes).\n2026-05-28 19:34:27,357 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC09B0000: C:\\Windows\\system32\\NLAapi (0x1d000 bytes).\n2026-05-28 19:34:27,358 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC58E0000: C:\\Windows\\System32\\CFGMGR32 (0x4e000 bytes).\n2026-05-28 19:34:27,360 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB9B80000: C:\\Windows\\System32\\StructuredQuery (0xa6000 bytes).\n2026-05-28 19:34:27,360 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC6CF0000: C:\\Windows\\System32\\NSI (0x8000 bytes).\n2026-05-28 19:34:27,361 [root] DEBUG: 5704: DLL loaded at 0x00007FFBBEFD0000: C:\\Windows\\SYSTEM32\\dhcpcsvc6 (0x17000 bytes).\n2026-05-28 19:34:27,362 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC0DB0000: C:\\Windows\\SYSTEM32\\PROPSYS (0xf6000 bytes).\n2026-05-28 19:34:27,363 [root] DEBUG: 5704: DLL loaded at 0x00007FFBBDC90000: C:\\Windows\\SYSTEM32\\dhcpcsvc (0x1d000 bytes).\n2026-05-28 19:34:27,364 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC4630000: C:\\Windows\\SYSTEM32\\DNSAPI (0xca000 bytes).\n2026-05-28 19:34:27,365 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB5D90000: C:\\Windows\\System32\\Windows.StateRepositoryPS (0x146000 bytes).\n2026-05-28 19:34:27,369 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC2820000: C:\\Windows\\System32\\CoreMessaging (0xf2000 bytes).\n2026-05-28 19:34:27,370 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC1080000: C:\\Windows\\SYSTEM32\\wintypes (0x155000 bytes).\n2026-05-28 19:34:27,370 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC2140000: C:\\Windows\\System32\\CoreUIComponents (0x35b000 bytes).\n2026-05-28 19:34:27,371 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB9560000: C:\\Windows\\SYSTEM32\\textinputframework (0xf9000 bytes).\n2026-05-28 19:34:27,371 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB5CA0000: C:\\Windows\\system32\\Windows.Storage.Search (0xc6000 bytes).\n2026-05-28 19:34:27,375 [root] DEBUG: 5704: DLL loaded at 0x00007FFBBF7E0000: C:\\Windows\\System32\\twinapi.appcore (0x203000 bytes).\n2026-05-28 19:34:27,376 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB55B0000: C:\\Windows\\system32\\mssprxy (0x28000 bytes).\n2026-05-28 19:34:27,378 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB1AE0000: C:\\Windows\\system32\\twinapi (0xa9000 bytes).\n2026-05-28 19:34:27,383 [root] DEBUG: 5704: DLL loaded at 0x00007FFBBF690000: C:\\Windows\\SYSTEM32\\wevtapi (0x65000 bytes).\n2026-05-28 19:34:27,384 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB5200000: C:\\Windows\\SYSTEM32\\edputil (0x24000 bytes).\n2026-05-28 19:34:27,389 [root] DEBUG: 5704: DLL loaded at 0x00007FFBBFB00000: C:\\Windows\\System32\\WindowManagementAPI (0xa1000 bytes).\n2026-05-28 19:34:27,390 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB9400000: C:\\Windows\\System32\\InputHost (0x152000 bytes).\n2026-05-28 19:34:27,391 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB9660000: C:\\Windows\\System32\\Windows.UI (0x141000 bytes).\n2026-05-28 19:34:27,393 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB9F00000: C:\\Windows\\System32\\iertutil (0x2bc000 bytes).\n2026-05-28 19:34:27,393 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB5110000: C:\\Windows\\System32\\Windows.Web (0xc3000 bytes).\n2026-05-28 19:34:27,396 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC0EE0000: C:\\Windows\\SYSTEM32\\WTSAPI32 (0x14000 bytes).\n2026-05-28 19:34:27,398 [root] DEBUG: 5704: DLL loaded at 0x00007FFBBF590000: C:\\Windows\\SYSTEM32\\ColorAdapterClient (0x11000 bytes).\n2026-05-28 19:34:27,398 [root] DEBUG: 5704: DLL loaded at 0x00007FFBBF5B0000: C:\\Windows\\SYSTEM32\\mscms (0xae000 bytes).\n2026-05-28 19:34:27,399 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC4B90000: C:\\Windows\\SYSTEM32\\WINSTA (0x5b000 bytes).\n2026-05-28 19:34:27,432 [root] DEBUG: 5704: DLL loaded at 0x00007FFBBF9F0000: C:\\Windows\\SYSTEM32\\WINHTTP (0x10a000 bytes).\n2026-05-28 19:34:27,440 [root] DEBUG: 5704: DLL loaded at 0x00007FFB6FDF0000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\oneauth (0x5c4000 bytes).\n2026-05-28 19:34:27,451 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB81B0000: C:\\Windows\\System32\\Windows.UI.Immersive (0x139000 bytes).\n2026-05-28 19:34:27,454 [root] DEBUG: 5704: CreateProcessHandler: Injection info set for new process 8524: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF66C3B0000\n2026-05-28 19:34:27,454 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB6910000: C:\\Windows\\SYSTEM32\\Secur32 (0xc000 bytes).\n2026-05-28 19:34:27,455 [root] DEBUG: 5704: caller_dispatch: Added region at 0x00007FF66C3B0000 to tracked regions list (kernel32::CreateProcessInternalW returns to 0x00007FF66C4A7D66, thread 8224).\n2026-05-28 19:34:27,455 [root] DEBUG: 5704: caller_dispatch: Added region at 0x00007FF66C3B0000 to tracked regions list (kernel32::CreateProcessInternalW returns to 0x00007FF66C4A7D66, thread 8224).\n2026-05-28 19:34:27,456 [root] DEBUG: 5704: ProcessMessage: Skipping monitoring process 8524\n2026-05-28 19:34:27,460 [root] DEBUG: 5704: ProcessImageBase: Main module image at 0x00007FF66C3B0000 unmodified (entropy change 0.000000e+00)\n2026-05-28 19:34:27,462 [root] DEBUG: 5704: CreateProcessHandler: Injection info set for new process 8560: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF66C3B0000\n2026-05-28 19:34:27,462 [root] DEBUG: 5704: ProcessMessage: Skipping monitoring process 8560\n2026-05-28 19:34:27,473 [root] DEBUG: 5704: ProcessMessage: Skipping monitoring process 8560\n2026-05-28 19:34:27,475 [root] DEBUG: 5704: CreateProcessHandler: Injection info set for new process 8604: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF66C3B0000\n2026-05-28 19:34:27,475 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC5030000: C:\\Windows\\SYSTEM32\\sxs (0xa2000 bytes).\n2026-05-28 19:34:27,479 [root] DEBUG: 5704: ProcessMessage: Skipping monitoring process 8604\n2026-05-28 19:34:27,480 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB4F60000: C:\\Windows\\SYSTEM32\\LINKINFO (0xd000 bytes).\n2026-05-28 19:34:27,491 [root] DEBUG: 5704: ProcessMessage: Skipping monitoring process 8604\n2026-05-28 19:34:27,511 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC0580000: C:\\Windows\\SYSTEM32\\usermgrcli (0x16000 bytes).\n2026-05-28 19:34:27,514 [root] DEBUG: 5704: DLL loaded at 0x00007FFBAE420000: C:\\Windows\\System32\\Windows.Internal.UI.Shell.WindowTabManager (0x6d000 bytes).\n2026-05-28 19:34:27,564 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC3AF0000: C:\\Windows\\system32\\dxgi (0xf3000 bytes).\n2026-05-28 19:34:27,565 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC1C00000: C:\\Windows\\system32\\d3d11 (0x263000 bytes).\n2026-05-28 19:34:27,565 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC1E70000: C:\\Windows\\system32\\dcomp (0x1e3000 bytes).\n2026-05-28 19:34:27,566 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB1D70000: C:\\Windows\\system32\\dataexchange (0x3e000 bytes).\n2026-05-28 19:34:27,596 [root] DEBUG: 5704: DLL loaded at 0x00007FFBAD7D0000: C:\\Windows\\System32\\Windows.System.Profile.RetailInfo (0x28000 bytes).\n2026-05-28 19:34:27,613 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC2D40000: C:\\Windows\\SYSTEM32\\dwmapi (0x2f000 bytes).\n2026-05-28 19:34:27,621 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB0FD0000: C:\\Windows\\SYSTEM32\\OLEACC (0x66000 bytes).\n2026-05-28 19:34:27,621 [root] DEBUG: 5704: CreateProcessHandler: Injection info set for new process 8900: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF66C3B0000\n2026-05-28 19:34:27,622 [root] DEBUG: 5704: CreateProcessHandler: Injection info set for new process 8908: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF66C3B0000\n2026-05-28 19:34:27,622 [root] DEBUG: 5704: ProcessMessage: Skipping monitoring process 8900\n2026-05-28 19:34:27,622 [root] DEBUG: 5704: ProcessMessage: Skipping monitoring process 8908\n2026-05-28 19:34:27,623 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB6C40000: C:\\Windows\\system32\\directmanipulation (0x9d000 bytes).\n2026-05-28 19:34:27,623 [root] DEBUG: 5704: ProcessMessage: Skipping monitoring process 8900\n2026-05-28 19:34:27,623 [root] DEBUG: 5704: ProcessMessage: Skipping monitoring process 8908\n2026-05-28 19:34:27,730 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB2FE0000: C:\\Windows\\System32\\Windows.Security.Authentication.Web.Core (0x11d000 bytes).\n2026-05-28 19:34:27,737 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB6E10000: C:\\Windows\\System32\\OneCoreCommonProxyStub (0x7f000 bytes).\n2026-05-28 19:34:27,745 [root] DEBUG: 5704: DLL loaded at 0x00007FFBAD430000: C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Well Known Domains\\1.2.0.0\\well_known_domains (0x9e000 bytes).\n2026-05-28 19:34:27,756 [root] DEBUG: 5704: DLL loaded at 0x00007FFBA7AE0000: C:\\Windows\\System32\\vaultcli (0x51000 bytes).\n2026-05-28 19:34:27,760 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC4D80000: C:\\Windows\\SYSTEM32\\MSASN1 (0x12000 bytes).\n2026-05-28 19:34:27,763 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC4AF0000: C:\\Windows\\SYSTEM32\\CRYPTSP (0x18000 bytes).\n2026-05-28 19:34:27,765 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC4230000: C:\\Windows\\system32\\rsaenh (0x34000 bytes).\n2026-05-28 19:34:27,814 [root] DEBUG: 5704: DLL loaded at 0x00007FFB6D120000: C:\\Windows\\System32\\MicrosoftAccountWAMExtension (0x8c000 bytes).\n2026-05-28 19:34:28,997 [root] DEBUG: 5704: DLL loaded at 0x00007FFBAD2F0000: C:\\Windows\\System32\\ShellCommonCommonProxyStub (0xe4000 bytes).\n2026-05-28 19:34:29,317 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC42C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-28 19:34:29,322 [root] DEBUG: 5704: DLL loaded at 0x00007FFBBF330000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-28 19:34:29,328 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB0A40000: C:\\Windows\\system32\\explorerframe (0x244000 bytes).\n2026-05-28 19:34:29,350 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC6820000: C:\\Windows\\System32\\SETUPAPI (0x46e000 bytes).\n2026-05-28 19:34:29,356 [root] DEBUG: 5704: CreateProcessHandler: Injection info set for new process 9208: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF66C3B0000\n2026-05-28 19:34:29,359 [root] DEBUG: 5704: CreateProcessHandler: Injection info set for new process 8552: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF66C3B0000\n2026-05-28 19:34:29,361 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC0660000: C:\\Windows\\System32\\netprofm (0x3f000 bytes).\n2026-05-28 19:34:29,362 [root] DEBUG: 5704: ProcessMessage: Skipping monitoring process 8552\n2026-05-28 19:34:29,364 [root] DEBUG: 5704: ProcessMessage: Skipping monitoring process 9208\n2026-05-28 19:34:29,367 [root] DEBUG: 5704: ProcessMessage: Skipping monitoring process 8552\n2026-05-28 19:34:29,369 [root] DEBUG: 5704: ProcessMessage: Skipping monitoring process 9208\n2026-05-28 19:34:29,387 [root] DEBUG: 5704: DLL loaded at 0x00007FFB6CD30000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\telclient (0x3ed000 bytes).\n2026-05-28 19:34:29,406 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC4F50000: C:\\Windows\\SYSTEM32\\DEVOBJ (0x33000 bytes).\n2026-05-28 19:34:29,407 [root] DEBUG: 5704: DLL loaded at 0x00007FFBBD900000: C:\\Windows\\System32\\npmproxy (0x10000 bytes).\n2026-05-28 19:34:29,408 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB0E60000: C:\\Windows\\System32\\Windows.FileExplorer.Common (0x61000 bytes).\n2026-05-28 19:34:29,413 [root] DEBUG: 5704: DLL loaded at 0x00007FFB6C6D0000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\oneds (0x33f000 bytes).\n2026-05-28 19:34:29,420 [root] DEBUG: 5704: DLL loaded at 0x00007FFB6F800000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\ffmpeg (0x467000 bytes).\n2026-05-28 19:34:29,422 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC5930000: C:\\Windows\\System32\\WINTRUST (0x67000 bytes).\n2026-05-28 19:34:29,423 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC3E50000: C:\\Windows\\System32\\FirewallAPI (0x96000 bytes).\n2026-05-28 19:34:29,424 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC3E10000: C:\\Windows\\System32\\fwbase (0x36000 bytes).\n2026-05-28 19:34:29,426 [root] DEBUG: 5704: DLL loaded at 0x00007FFBAD6F0000: C:\\Windows\\system32\\TenantRestrictionsPlugin (0x1b000 bytes).\n2026-05-28 19:34:29,430 [root] DEBUG: 5704: DLL loaded at 0x00007FFB6C650000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\microsoft_shell_integration (0x78000 bytes).\n2026-05-28 19:34:29,436 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC6DE0000: C:\\Windows\\System32\\coml2 (0x79000 bytes).\n2026-05-28 19:34:29,440 [root] DEBUG: 5704: CreateProcessHandler: Injection info set for new process 7488: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe, ImageBase: 0x00007FF64B540000\n2026-05-28 19:34:29,441 [root] INFO: Announced 64-bit process name: identity_helper.exe pid: 7488\n2026-05-28 19:34:29,442 [lib.api.process] INFO: Monitor config for process 7488: C:\\hsngo5k_\\dll\\7488.ini\n2026-05-28 19:34:29,446 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC2F30000: C:\\Windows\\System32\\RMCLIENT (0x2a000 bytes).\n2026-05-28 19:34:29,447 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC0D70000: C:\\Windows\\System32\\XmlLite (0x36000 bytes).\n2026-05-28 19:34:29,447 [root] DEBUG: 5704: CreateProcessHandler: Injection info set for new process 9228: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF66C3B0000\n2026-05-28 19:34:29,449 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB08E0000: C:\\Windows\\System32\\wpnapps (0x15b000 bytes).\n2026-05-28 19:34:29,451 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 19:34:29,452 [root] DEBUG: 5704: ProcessMessage: Skipping monitoring process 9228\n2026-05-28 19:34:29,453 [root] DEBUG: 5704: CreateProcessHandler: Injection info set for new process 9260: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF66C3B0000\n2026-05-28 19:34:29,456 [root] DEBUG: 5704: ProcessMessage: Skipping monitoring process 9260\n2026-05-28 19:34:29,457 [root] DEBUG: 5704: ProcessMessage: Skipping monitoring process 9228\n2026-05-28 19:34:29,461 [root] DEBUG: 5704: ProcessMessage: Skipping monitoring process 9260\n2026-05-28 19:34:29,482 [root] DEBUG: 5704: DLL loaded at 0x00007FFBBFEB0000: C:\\Windows\\SYSTEM32\\WindowsCodecs (0x1b4000 bytes).\n2026-05-28 19:34:29,491 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB0100000: C:\\Windows\\System32\\thumbcache (0x66000 bytes).\n2026-05-28 19:34:29,498 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC42C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-28 19:34:29,498 [root] DEBUG: 5704: DLL loaded at 0x00007FFBBF330000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-28 19:34:29,944 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll\n2026-05-28 19:34:29,944 [lib.api.process] INFO: Potential dll side-loading detected in local directory: onnxruntime.dll\n2026-05-28 19:34:29,948 [lib.api.process] INFO: 64-bit DLL to inject is C:\\hsngo5k_\\dll\\gIlsNlf.dll, loader C:\\hsngo5k_\\bin\\vouhCgRr.exe\n2026-05-28 19:34:29,953 [root] DEBUG: Loader: Injecting process 7488 (thread 2544) with C:\\hsngo5k_\\dll\\gIlsNlf.dll.\n2026-05-28 19:34:29,953 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 19:34:29,954 [root] DEBUG: Successfully injected DLL C:\\hsngo5k_\\dll\\gIlsNlf.dll.\n2026-05-28 19:34:29,955 [lib.api.process] INFO: Injected into 64-bit \n2026-05-28 19:34:29,964 [root] DEBUG: 5704: DLL loaded at 0x00007FFBBCF40000: C:\\Windows\\SYSTEM32\\capauthz (0x51000 bytes).\n2026-05-28 19:34:29,965 [root] DEBUG: 5704: DLL loaded at 0x00007FFBBBA60000: C:\\Windows\\SYSTEM32\\windows.staterepositorycore (0x11000 bytes).\n2026-05-28 19:34:29,966 [root] DEBUG: 5704: CreateProcessHandler: Injection info set for new process 9452: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe, ImageBase: 0x00007FF64B540000\n2026-05-28 19:34:29,968 [root] INFO: Announced 64-bit process name: identity_helper.exe pid: 9452\n2026-05-28 19:34:29,968 [lib.api.process] INFO: Monitor config for process 9452: C:\\hsngo5k_\\dll\\9452.ini\n2026-05-28 19:34:29,969 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 19:34:29,984 [root] DEBUG: 5704: DLL loaded at 0x00007FFBBD0C0000: C:\\Windows\\system32\\wlanapi (0x74000 bytes).\n2026-05-28 19:34:29,992 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB3900000: C:\\Windows\\System32\\Windows.ApplicationModel (0xe9000 bytes).\n2026-05-28 19:34:29,993 [root] DEBUG: 5704: DLL loaded at 0x00007FFBBE410000: C:\\Windows\\System32\\AppXDeploymentClient (0x102000 bytes).\n2026-05-28 19:34:30,015 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC4C60000: C:\\Windows\\SYSTEM32\\ncrypt (0x27000 bytes).\n2026-05-28 19:34:30,016 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC4C20000: C:\\Windows\\SYSTEM32\\NTASN1 (0x3b000 bytes).\n2026-05-28 19:34:30,017 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB3170000: C:\\Windows\\SYSTEM32\\NETAPI32 (0x19000 bytes).\n2026-05-28 19:34:30,017 [root] DEBUG: 5704: DLL loaded at 0x00007FFBBCFA0000: C:\\Windows\\system32\\PCPKsp (0x118000 bytes).\n2026-05-28 19:34:30,018 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC6800000: C:\\Windows\\System32\\imagehlp (0x1d000 bytes).\n2026-05-28 19:34:30,019 [root] DEBUG: 5704: DLL loaded at 0x00007FFBBCE20000: C:\\Windows\\SYSTEM32\\tbs (0x1b000 bytes).\n2026-05-28 19:34:30,020 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB23C0000: C:\\Windows\\system32\\ncryptprov (0x5a000 bytes).\n2026-05-28 19:34:30,028 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC4900000: C:\\Windows\\system32\\mswsock (0x6a000 bytes).\n2026-05-28 19:34:30,045 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll\n2026-05-28 19:34:30,046 [lib.api.process] INFO: Potential dll side-loading detected in local directory: onnxruntime.dll\n2026-05-28 19:34:30,049 [lib.api.process] INFO: 64-bit DLL to inject is C:\\hsngo5k_\\dll\\gIlsNlf.dll, loader C:\\hsngo5k_\\bin\\vouhCgRr.exe\n2026-05-28 19:34:30,054 [root] DEBUG: Loader: Injecting process 9452 (thread 9456) with C:\\hsngo5k_\\dll\\gIlsNlf.dll.\n2026-05-28 19:34:30,054 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 19:34:30,055 [root] DEBUG: Successfully injected DLL C:\\hsngo5k_\\dll\\gIlsNlf.dll.\n2026-05-28 19:34:30,056 [lib.api.process] INFO: Injected into 64-bit \n2026-05-28 19:34:30,058 [root] INFO: Announced 64-bit process name: identity_helper.exe pid: 9452\n2026-05-28 19:34:30,058 [lib.api.process] INFO: Monitor config for process 9452: C:\\hsngo5k_\\dll\\9452.ini\n2026-05-28 19:34:30,058 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 19:34:30,126 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll\n2026-05-28 19:34:30,126 [lib.api.process] INFO: Potential dll side-loading detected in local directory: onnxruntime.dll\n2026-05-28 19:34:30,128 [lib.api.process] INFO: 64-bit DLL to inject is C:\\hsngo5k_\\dll\\gIlsNlf.dll, loader C:\\hsngo5k_\\bin\\vouhCgRr.exe\n2026-05-28 19:34:30,132 [root] DEBUG: Loader: Injecting process 9452 (thread 9456) with C:\\hsngo5k_\\dll\\gIlsNlf.dll.\n2026-05-28 19:34:30,132 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 19:34:30,133 [root] DEBUG: Successfully injected DLL C:\\hsngo5k_\\dll\\gIlsNlf.dll.\n2026-05-28 19:34:30,134 [lib.api.process] INFO: Injected into 64-bit \n2026-05-28 19:34:30,144 [root] DEBUG: 9452: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-28 19:34:30,145 [root] DEBUG: 9452: Interactive desktop enabled.\n2026-05-28 19:34:30,145 [root] DEBUG: 9452: Dropped file limit defaulting to 100.\n2026-05-28 19:34:30,152 [root] DEBUG: 9452: Disabling sleep skipping.\n2026-05-28 19:34:30,153 [root] DEBUG: 9452: YaraInit: Compiled rules loaded from existing file C:\\hsngo5k_\\data\\yara\\capemon.yac\n2026-05-28 19:34:30,164 [root] DEBUG: 9452: RtlInsertInvertedFunctionTable 0x00007FFBC7B6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFBC7CBD4F0\n2026-05-28 19:34:30,164 [root] DEBUG: 9452: YaraScan: Scanning 0x00007FF64B540000, size 0x28b4d8\n2026-05-28 19:34:30,181 [root] DEBUG: 9452: Monitor initialised: 64-bit capemon loaded in process 9452 at 0x00007FFB863A0000, thread 9456, image base 0x00007FF64B540000, stack from 0x000000445D724000-0x000000445D730000\n2026-05-28 19:34:30,181 [root] DEBUG: 9452: Commandline: \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5816,i,7984218614831481947,5522388298470254199,524288 --field-trial-handle=2320,i,14929327369621157306,4202929281633177340,262144 --variations-seed-version --pseudonymization-salt-handle=2324,i,18132106635844096711,14831399794136510\n2026-05-28 19:34:30,182 [root] DEBUG: 9452: add_all_dlls_to_dll_ranges: skipping C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf.dll\n2026-05-28 19:34:30,194 [root] DEBUG: 9452: hook_api: LdrpCallInitRoutine export address 0x00007FFBC7B699BC obtained via GetFunctionAddress\n2026-05-28 19:34:30,216 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'\n2026-05-28 19:34:30,217 [root] DEBUG: 9452: set_hooks: Unable to hook LockResource\n2026-05-28 19:34:30,223 [root] DEBUG: 9452: Hooked 627 out of 628 functions\n2026-05-28 19:34:30,238 [root] DEBUG: 9452: Syscall hook installed, syscall logging level 1\n2026-05-28 19:34:30,242 [root] DEBUG: 9452: RestoreHeaders: Restored original import table.\n2026-05-28 19:34:30,243 [root] INFO: Loaded monitor into process with pid 9452\n2026-05-28 19:34:30,244 [root] DEBUG: 9452: YaraScan: Scanning 0x00007FFB84E10000, size 0x4b9994\n2026-05-28 19:34:30,284 [root] DEBUG: 9452: YaraScan: Scanning 0x00007FFB84E10000, size 0x4b9994\n2026-05-28 19:34:30,308 [root] DEBUG: 9452: YaraScan: Scanning 0x00007FFB84E10000, size 0x4b9994\n2026-05-28 19:34:30,333 [root] DEBUG: 9452: YaraScan: Scanning 0x00007FFB84E10000, size 0x4b9994\n2026-05-28 19:34:30,357 [root] DEBUG: 9452: YaraScan: Scanning 0x00007FFB84E10000, size 0x4b9994\n2026-05-28 19:34:30,382 [root] DEBUG: 9452: YaraScan: Scanning 0x00007FFB84E10000, size 0x4b9994\n2026-05-28 19:34:30,406 [root] DEBUG: 9452: YaraScan: Scanning 0x00007FFB84E10000, size 0x4b9994\n2026-05-28 19:34:30,434 [root] DEBUG: 9452: caller_dispatch: Added region at 0x00007FFB84E10000 to tracked regions list (ntdll::NtProtectVirtualMemory returns to 0x00007FFB8500F156, thread 9456).\n2026-05-28 19:34:30,435 [root] DEBUG: 9452: caller_dispatch: Scanning calling region at 0x00007FFB84E10000...\n2026-05-28 19:34:30,439 [root] DEBUG: 9452: ProcessTrackedRegion: Region at 0x00007FFB84E10000 mapped as \\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf.dll appears unmodified, skipping\n2026-05-28 19:34:30,441 [root] DEBUG: 9452: DLL loaded at 0x00007FFBC5750000: C:\\Windows\\System32\\bcryptprimitives (0x82000 bytes).\n2026-05-28 19:34:30,465 [root] DEBUG: 9452: YaraScan: Scanning 0x00007FF64B540000, size 0x28b4d8\n2026-05-28 19:34:30,480 [root] DEBUG: 9452: YaraScan: Scanning 0x00007FF64B540000, size 0x28b4d8\n2026-05-28 19:34:30,496 [root] DEBUG: 9452: YaraScan: Scanning 0x00007FF64B540000, size 0x28b4d8\n2026-05-28 19:34:30,511 [root] DEBUG: 9452: YaraScan: Scanning 0x00007FF64B540000, size 0x28b4d8\n2026-05-28 19:34:30,526 [root] DEBUG: 9452: YaraScan: Scanning 0x00007FF64B540000, size 0x28b4d8\n2026-05-28 19:34:30,542 [root] DEBUG: 9452: YaraScan: Scanning 0x00007FF64B540000, size 0x28b4d8\n2026-05-28 19:34:30,559 [root] DEBUG: 9452: caller_dispatch: Added region at 0x00007FF64B540000 to tracked regions list (ntdll::NtProtectVirtualMemory returns to 0x00007FF64B634096, thread 9456).\n2026-05-28 19:34:30,560 [root] DEBUG: 9452: YaraScan: Scanning 0x00007FF64B540000, size 0x28b4d8\n2026-05-28 19:34:30,576 [root] DEBUG: 9452: ProcessImageBase: Main module image at 0x00007FF64B540000 unmodified (entropy change 0.000000e+00)\n2026-05-28 19:34:30,579 [root] DEBUG: 9452: DLL loaded at 0x00007FFBC5C20000: C:\\Windows\\System32\\shcore (0xad000 bytes).\n2026-05-28 19:34:30,611 [root] DEBUG: 9452: DLL loaded at 0x000001BCEB000000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge (0x136be000 bytes).\n2026-05-28 19:34:30,614 [root] DEBUG: 9452: DLL loaded at 0x00007FFBC2BF0000: C:\\Windows\\system32\\uxtheme (0x9e000 bytes).\n2026-05-28 19:34:30,618 [root] DEBUG: 9452: DLL loaded at 0x00007FFBC7690000: C:\\Windows\\System32\\MSCTF (0x114000 bytes).\n2026-05-28 19:34:30,652 [root] DEBUG: 9452: DLL loaded at 0x00007FFBC3110000: C:\\Windows\\SYSTEM32\\kernel.appcore (0x12000 bytes).\n2026-05-28 19:34:30,657 [root] DEBUG: 9452: DLL loaded at 0x00007FFBC7A60000: C:\\Windows\\System32\\clbcatq (0xa9000 bytes).\n2026-05-28 19:34:30,713 [root] DEBUG: 9452: DLL loaded at 0x00007FFBC5C20000: C:\\Windows\\System32\\shcore (0xad000 bytes).\n2026-05-28 19:34:30,717 [root] DEBUG: 9452: DLL loaded at 0x00007FFBC0DB0000: C:\\Windows\\System32\\PROPSYS (0xf6000 bytes).\n2026-05-28 19:34:30,718 [root] DEBUG: 9452: DLL loaded at 0x00007FFBC2820000: C:\\Windows\\System32\\CoreMessaging (0xf2000 bytes).\n2026-05-28 19:34:30,720 [root] DEBUG: 9452: DLL loaded at 0x00007FFBB5020000: C:\\Windows\\System32\\execmodelclient (0x63000 bytes).\n2026-05-28 19:34:30,802 [root] DEBUG: 9452: DLL loaded at 0x00007FFBC1080000: C:\\Windows\\SYSTEM32\\wintypes (0x155000 bytes).\n2026-05-28 19:34:30,803 [root] DEBUG: 9452: DLL loaded at 0x00007FFBC2F30000: C:\\Windows\\System32\\RMCLIENT (0x2a000 bytes).\n2026-05-28 19:34:30,804 [root] DEBUG: 9452: DLL loaded at 0x00007FFBC0D70000: C:\\Windows\\System32\\XmlLite (0x36000 bytes).\n2026-05-28 19:34:30,804 [root] DEBUG: 9452: DLL loaded at 0x00007FFBBF7E0000: C:\\Windows\\System32\\twinapi.appcore (0x203000 bytes).\n2026-05-28 19:34:30,805 [root] DEBUG: 9452: DLL loaded at 0x00007FFBB08E0000: C:\\Windows\\System32\\wpnapps (0x15b000 bytes).\n2026-05-28 19:34:30,923 [root] DEBUG: 9452: DLL loaded at 0x00007FFBB6E10000: C:\\Windows\\System32\\OneCoreCommonProxyStub (0x7f000 bytes).\n2026-05-28 19:34:30,932 [root] DEBUG: 9452: DLL loaded at 0x00007FFBB3400000: C:\\Windows\\system32\\execmodelproxy (0x18000 bytes).\n2026-05-28 19:34:30,938 [root] DEBUG: 9452: DLL loaded at 0x00007FFBC42C0000: C:\\Windows\\System32\\msvcp110_win (0x8a000 bytes).\n2026-05-28 19:34:30,939 [root] DEBUG: 9452: DLL loaded at 0x00007FFBBF330000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-28 19:34:30,957 [root] DEBUG: 9452: DLL loaded at 0x00007FFBC0580000: C:\\Windows\\SYSTEM32\\usermgrcli (0x16000 bytes).\n2026-05-28 19:34:30,973 [root] DEBUG: 9452: DLL loaded at 0x00007FFBBE780000: C:\\Windows\\System32\\OneCoreUAPCommonProxyStub (0x7d0000 bytes).\n2026-05-28 19:34:30,984 [root] DEBUG: 9452: DLL loaded at 0x00007FFBB5D90000: C:\\Windows\\System32\\Windows.StateRepositoryPS (0x146000 bytes).\n2026-05-28 19:34:30,992 [root] DEBUG: 9452: DLL loaded at 0x00007FFBC5930000: C:\\Windows\\System32\\WINTRUST (0x67000 bytes).\n2026-05-28 19:34:30,993 [root] DEBUG: 9452: DLL loaded at 0x00007FFBBCF40000: C:\\Windows\\SYSTEM32\\capauthz (0x51000 bytes).\n2026-05-28 19:34:31,014 [root] DEBUG: 9452: DLL loaded at 0x00007FFBC4D80000: C:\\Windows\\System32\\MSASN1 (0x12000 bytes).\n2026-05-28 19:34:31,040 [root] DEBUG: 9452: DLL loaded at 0x00007FFBB3900000: C:\\Windows\\System32\\Windows.ApplicationModel (0xe9000 bytes).\n2026-05-28 19:34:31,115 [root] DEBUG: 9452: DLL loaded at 0x00007FFB888B0000: C:\\Windows\\System32\\CryptoWinRT (0x61000 bytes).\n2026-05-28 19:34:31,176 [lib.api.process] INFO: Monitor config for process 844: C:\\hsngo5k_\\dll\\844.ini\n2026-05-28 19:34:31,180 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 19:34:31,183 [lib.api.process] INFO: 64-bit DLL to inject is C:\\hsngo5k_\\dll\\gIlsNlf.dll, loader C:\\hsngo5k_\\bin\\vouhCgRr.exe\n2026-05-28 19:34:31,193 [root] DEBUG: Loader: Injecting process 844 with C:\\hsngo5k_\\dll\\gIlsNlf.dll.\n2026-05-28 19:34:31,198 [root] DEBUG: 844: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-28 19:34:31,201 [root] DEBUG: 844: Disabling sleep skipping.\n2026-05-28 19:34:31,204 [root] DEBUG: 844: Interactive desktop enabled.\n2026-05-28 19:34:31,206 [root] DEBUG: 844: Dropped file limit defaulting to 100.\n2026-05-28 19:34:31,232 [root] DEBUG: 844: Services hook set enabled\n2026-05-28 19:34:31,234 [root] DEBUG: 844: YaraInit: Compiled rules loaded from existing file C:\\hsngo5k_\\data\\yara\\capemon.yac\n2026-05-28 19:34:31,246 [root] DEBUG: 844: RtlInsertInvertedFunctionTable 0x00007FFBC7B6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFBC7CBD4F0\n2026-05-28 19:34:31,247 [root] DEBUG: 844: Monitor initialised: 64-bit capemon loaded in process 844 at 0x00007FFB863A0000, thread 9968, image base 0x00007FF6A8E20000, stack from 0x00000092395F4000-0x0000009239600000\n2026-05-28 19:34:31,247 [root] DEBUG: 844: Commandline: C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p\n2026-05-28 19:34:31,261 [root] DEBUG: 844: Hooked 69 out of 69 functions\n2026-05-28 19:34:31,262 [root] INFO: Loaded monitor into process with pid 844\n2026-05-28 19:34:31,262 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.\n2026-05-28 19:34:31,263 [root] DEBUG: Successfully injected DLL C:\\hsngo5k_\\dll\\gIlsNlf.dll.\n2026-05-28 19:34:31,264 [lib.api.process] INFO: Injected into 64-bit \n2026-05-28 19:34:33,323 [root] DEBUG: 9452: DLL loaded at 0x00007FFBBAD00000: C:\\Windows\\System32\\StateRepository.Core (0xb1000 bytes).\n2026-05-28 19:34:33,327 [root] DEBUG: 9452: DLL loaded at 0x00007FFBBADC0000: C:\\Windows\\System32\\Windows.StateRepository (0x58e000 bytes).\n2026-05-28 19:34:33,328 [root] DEBUG: 9452: DLL loaded at 0x00007FFBB0CC0000: C:\\Windows\\System32\\TileDataRepository (0x99000 bytes).\n2026-05-28 19:34:33,329 [root] DEBUG: 9452: DLL loaded at 0x00007FFBAC310000: C:\\Windows\\System32\\biwinrt (0x53000 bytes).\n2026-05-28 19:34:33,339 [root] DEBUG: 9452: DLL loaded at 0x00007FFBBDCB0000: C:\\Windows\\System32\\usermgrproxy (0x54000 bytes).\n2026-05-28 19:34:33,412 [root] DEBUG: 9452: DLL loaded at 0x00007FFBC3AF0000: C:\\Windows\\System32\\dxgi (0xf3000 bytes).\n2026-05-28 19:34:33,414 [root] DEBUG: 9452: DLL loaded at 0x00007FFBC1C00000: C:\\Windows\\System32\\d3d11 (0x263000 bytes).\n2026-05-28 19:34:33,439 [root] DEBUG: 9452: DLL loaded at 0x00007FFBB7020000: C:\\Windows\\System32\\WININET (0x4d6000 bytes).\n2026-05-28 19:34:33,442 [root] DEBUG: 9452: DLL loaded at 0x00007FFBAC200000: C:\\Windows\\System32\\windows.internal.shell.broker (0xdd000 bytes).\n2026-05-28 19:34:33,623 [root] DEBUG: 9452: DLL loaded at 0x00007FFBAD3E0000: C:\\Windows\\System32\\PCShellCommonProxyStub (0x13000 bytes).\n2026-05-28 19:34:33,739 [root] DEBUG: 9452: DLL loaded at 0x00007FFBC5120000: C:\\Windows\\System32\\USERENV (0x2e000 bytes).\n2026-05-28 19:34:33,742 [root] DEBUG: 9452: DLL loaded at 0x00007FFBC4BF0000: C:\\Windows\\System32\\Wldp (0x2d000 bytes).\n2026-05-28 19:34:33,743 [root] DEBUG: 9452: DLL loaded at 0x00007FFBC3310000: C:\\Windows\\SYSTEM32\\windows.storage (0x79b000 bytes).\n2026-05-28 19:34:33,744 [root] DEBUG: 9452: DLL loaded at 0x00007FFBBB460000: C:\\Windows\\System32\\Bcp47Langs (0x5b000 bytes).\n2026-05-28 19:34:33,746 [root] DEBUG: 9452: DLL loaded at 0x00007FFBB1090000: C:\\Windows\\System32\\StartTileData (0x58a000 bytes).\n2026-05-28 19:34:34,024 [root] DEBUG: 9452: DLL loaded at 0x00007FFBAC570000: C:\\Windows\\System32\\Windows.Storage.ApplicationData (0x66000 bytes).\n2026-05-28 19:34:34,072 [root] DEBUG: 9452: DLL loaded at 0x00007FFBB55B0000: C:\\Windows\\system32\\mssprxy (0x28000 bytes).\n2026-05-28 19:34:34,102 [root] DEBUG: 9452: DLL loaded at 0x00007FFBC58E0000: C:\\Windows\\System32\\CFGMGR32 (0x4e000 bytes).\n2026-05-28 19:34:44,198 [root] INFO: Process with pid 9452 has terminated\n2026-05-28 19:34:44,201 [root] DEBUG: 9452: NtTerminateProcess hook: Attempting to dump process 9452\n2026-05-28 19:34:44,205 [root] DEBUG: 9452: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-05-28 19:34:50,749 [root] DEBUG: 5704: DLL loaded at 0x00007FFBAC470000: C:\\Windows\\System32\\Windows.Security.Authentication.OnlineId (0xf4000 bytes).\n2026-05-28 19:34:50,932 [root] DEBUG: 5704: CreateProcessHandler: Injection info set for new process 9560: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF66C3B0000\n2026-05-28 19:34:50,933 [root] DEBUG: 5704: ProcessMessage: Skipping monitoring process 9560\n2026-05-28 19:34:50,934 [root] DEBUG: 5704: ProcessMessage: Skipping monitoring process 9560\n2026-05-28 19:34:56,647 [root] DEBUG: 5704: CreateProcessHandler: Injection info set for new process 7760: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF66C3B0000\n2026-05-28 19:34:56,648 [root] DEBUG: 5704: ProcessMessage: Skipping monitoring process 7760\n2026-05-28 19:34:56,649 [root] DEBUG: 5704: ProcessMessage: Skipping monitoring process 7760\n2026-05-28 19:34:57,312 [root] DEBUG: 5704: DLL loaded at 0x00007FFBC0960000: C:\\Windows\\System32\\Windows.System.UserProfile.DiagnosticsSettings (0x15000 bytes).\n2026-05-28 19:34:57,406 [root] DEBUG: 5704: CreateProcessHandler: Injection info set for new process 2224: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF66C3B0000\n2026-05-28 19:34:57,407 [root] DEBUG: 5704: ProcessMessage: Skipping monitoring process 2224\n2026-05-28 19:34:57,407 [root] DEBUG: 5704: ProcessMessage: Skipping monitoring process 2224\n2026-05-28 19:34:58,400 [root] DEBUG: 5704: DLL loaded at 0x00007FFBBA6C0000: C:\\Windows\\SYSTEM32\\srvcli (0x28000 bytes).\n2026-05-28 19:34:58,401 [root] DEBUG: 5704: DLL loaded at 0x00007FFBBA360000: C:\\Windows\\SYSTEM32\\urlmon (0x1ed000 bytes).\n2026-05-28 19:34:58,404 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB3880000: C:\\Windows\\SYSTEM32\\FLTLIB (0xb000 bytes).\n2026-05-28 19:34:58,405 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB6ED0000: C:\\Windows\\SYSTEM32\\virtdisk (0x13000 bytes).\n2026-05-28 19:34:58,406 [root] DEBUG: 5704: DLL loaded at 0x00007FFBB6CF0000: C:\\Windows\\System32\\smartscreenps (0x52000 bytes).\n2026-05-28 19:34:58,407 [root] DEBUG: 5704: DLL loaded at 0x00007FFBAA3E0000: C:\\Windows\\SYSTEM32\\shdocvw (0x41000 bytes).\n2026-05-28 19:34:58,739 [root] DEBUG: 4692: DLL loaded at 0x00007FFBB4B60000: C:\\Windows\\System32\\Windows.Shell.ServiceHostBuilder (0x1d000 bytes).\n2026-05-28 19:34:58,753 [root] DEBUG: 4692: AllocationHandler: Adding allocation to tracked region list: 0x00007DF4C7561000, size: 0x1000.\n2026-05-28 19:34:58,756 [root] DEBUG: 4692: AllocationHandler: Adding allocation to tracked region list: 0x00007DF4C7551000, size: 0x1000.\n2026-05-28 19:34:58,756 [root] DEBUG: 4692: AllocationHandler: Adding allocation to tracked region list: 0x00007DF4C7541000, size: 0x1000.\n2026-05-28 19:34:58,757 [root] DEBUG: 4692: AllocationHandler: Adding allocation to tracked region list: 0x00007DF4C7531000, size: 0x1000.\n2026-05-28 19:34:58,764 [root] DEBUG: 4692: AllocationHandler: Adding allocation to tracked region list: 0x00007DF4C7521000, size: 0x1000.\n2026-05-28 19:34:58,770 [root] DEBUG: 4692: DLL loaded at 0x00007FFBBD8B0000: C:\\Windows\\system32\\activationclient (0x12000 bytes).\n2026-05-28 19:34:58,783 [root] DEBUG: 844: CreateProcessHandler: Injection info set for new process 4404: C:\\Windows\\SystemApps\\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\\CHXSmartScreen.exe, ImageBase: 0x00007FF630AD0000\n2026-05-28 19:34:58,784 [root] INFO: Announced 64-bit process name: CHXSmartScreen.exe pid: 4404\n2026-05-28 19:34:58,784 [lib.api.process] INFO: Monitor config for process 4404: C:\\hsngo5k_\\dll\\4404.ini\n2026-05-28 19:34:58,785 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 19:34:58,786 [lib.api.process] INFO: 64-bit DLL to inject is C:\\hsngo5k_\\dll\\gIlsNlf.dll, loader C:\\hsngo5k_\\bin\\vouhCgRr.exe\n2026-05-28 19:34:58,790 [root] DEBUG: Loader: Injecting process 4404 (thread 4268) with C:\\hsngo5k_\\dll\\gIlsNlf.dll.\n2026-05-28 19:34:58,791 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 19:34:58,791 [root] DEBUG: Successfully injected DLL C:\\hsngo5k_\\dll\\gIlsNlf.dll.\n2026-05-28 19:34:58,793 [lib.api.process] INFO: Injected into 64-bit \n2026-05-28 19:34:58,794 [root] INFO: Announced 64-bit process name: CHXSmartScreen.exe pid: 4404\n2026-05-28 19:34:58,794 [lib.api.process] INFO: Monitor config for process 4404: C:\\hsngo5k_\\dll\\4404.ini\n2026-05-28 19:34:58,794 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 19:34:58,795 [lib.api.process] INFO: 64-bit DLL to inject is C:\\hsngo5k_\\dll\\gIlsNlf.dll, loader C:\\hsngo5k_\\bin\\vouhCgRr.exe\n2026-05-28 19:34:58,801 [root] DEBUG: Loader: Injecting process 4404 (thread 4268) with C:\\hsngo5k_\\dll\\gIlsNlf.dll.\n2026-05-28 19:34:58,801 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 19:34:58,802 [root] DEBUG: Successfully injected DLL C:\\hsngo5k_\\dll\\gIlsNlf.dll.\n2026-05-28 19:34:58,803 [lib.api.process] INFO: Injected into 64-bit \n2026-05-28 19:34:58,805 [root] INFO: Announced 64-bit process name: CHXSmartScreen.exe pid: 4404\n2026-05-28 19:34:58,805 [lib.api.process] INFO: Monitor config for process 4404: C:\\hsngo5k_\\dll\\4404.ini\n2026-05-28 19:34:58,805 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 19:34:58,806 [lib.api.process] INFO: 64-bit DLL to inject is C:\\hsngo5k_\\dll\\gIlsNlf.dll, loader C:\\hsngo5k_\\bin\\vouhCgRr.exe\n2026-05-28 19:34:58,811 [root] DEBUG: Loader: Injecting process 4404 with C:\\hsngo5k_\\dll\\gIlsNlf.dll.\n2026-05-28 19:34:58,812 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 4268, handle 0x120\n2026-05-28 19:34:58,813 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 19:34:58,813 [root] DEBUG: Successfully injected DLL C:\\hsngo5k_\\dll\\gIlsNlf.dll.\n2026-05-28 19:34:58,815 [lib.api.process] INFO: Injected into 64-bit \n2026-05-28 19:35:00,458 [root] DEBUG: 5704: CreateProcessHandler: Injection info set for new process 9420: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF66C3B0000\n2026-05-28 19:35:00,459 [root] DEBUG: 5704: ProcessMessage: Skipping monitoring process 9420\n2026-05-28 19:35:00,460 [root] DEBUG: 5704: ProcessMessage: Skipping monitoring process 9420\n2026-05-28 19:35:00,575 [root] INFO: Announced starting service \"b'MicrosoftEdgeElevationService'\"\n2026-05-28 19:35:00,578 [lib.api.process] INFO: Monitor config for process 632: C:\\hsngo5k_\\dll\\632.ini\n2026-05-28 19:35:00,587 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 19:35:00,588 [lib.api.process] INFO: 64-bit DLL to inject is C:\\hsngo5k_\\dll\\gIlsNlf.dll, loader C:\\hsngo5k_\\bin\\vouhCgRr.exe\n2026-05-28 19:35:00,602 [root] DEBUG: Loader: Injecting process 632 with C:\\hsngo5k_\\dll\\gIlsNlf.dll.\n2026-05-28 19:35:00,614 [root] DEBUG: Loader: Copied config file C:\\hsngo5k_\\dll\\632.ini to system path C:\\632.ini\n2026-05-28 19:35:00,618 [root] DEBUG: Loader: Unable to open process, launched: PPLinject64.exe 632 C:\\hsngo5k_\\dll\\gIlsNlf.dll\n2026-05-28 19:35:00,621 [root] DEBUG: Successfully injected DLL C:\\hsngo5k_\\dll\\gIlsNlf.dll.\n2026-05-28 19:35:00,625 [lib.api.process] INFO: Injected into 64-bit \n2026-05-28 19:35:01,140 [root] INFO: Process with pid 5704 appears to have terminated\n2026-05-28 19:35:04,215 [root] DEBUG: 4692: DLL loaded at 0x00007FFBAF610000: C:\\Windows\\system32\\twext (0x33000 bytes).\n2026-05-28 19:35:04,286 [root] DEBUG: 4692: DLL loaded at 0x00007FFBAA9A0000: C:\\Windows\\SYSTEM32\\MsftEdit (0x34d000 bytes).\n2026-05-28 19:35:04,293 [root] DEBUG: 4692: DLL loaded at 0x00007FFB6D450000: C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf (0xa9000 bytes).\n2026-05-28 19:35:04,310 [root] DEBUG: 4692: DLL loaded at 0x00007FFB6D060000: C:\\Windows\\system32\\UIRibbon (0x3ec000 bytes).\n2026-05-28 19:35:04,531 [root] DEBUG: 844: CreateProcessHandler: Injection info set for new process 8996: C:\\Windows\\system32\\DllHost.exe, ImageBase: 0x00007FF69BCF0000\n2026-05-28 19:35:04,532 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 8996\n2026-05-28 19:35:04,533 [lib.api.process] INFO: Monitor config for process 8996: C:\\hsngo5k_\\dll\\8996.ini\n2026-05-28 19:35:04,534 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 19:35:04,539 [lib.api.process] INFO: 64-bit DLL to inject is C:\\hsngo5k_\\dll\\gIlsNlf.dll, loader C:\\hsngo5k_\\bin\\vouhCgRr.exe\n2026-05-28 19:35:04,544 [root] DEBUG: Loader: Injecting process 8996 (thread 9004) with C:\\hsngo5k_\\dll\\gIlsNlf.dll.\n2026-05-28 19:35:04,545 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 19:35:04,546 [root] DEBUG: Successfully injected DLL C:\\hsngo5k_\\dll\\gIlsNlf.dll.\n2026-05-28 19:35:04,550 [lib.api.process] INFO: Injected into 64-bit \n2026-05-28 19:35:04,554 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 8996\n2026-05-28 19:35:04,554 [lib.api.process] INFO: Monitor config for process 8996: C:\\hsngo5k_\\dll\\8996.ini\n2026-05-28 19:35:04,555 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 19:35:04,558 [lib.api.process] INFO: 64-bit DLL to inject is C:\\hsngo5k_\\dll\\gIlsNlf.dll, loader C:\\hsngo5k_\\bin\\vouhCgRr.exe\n2026-05-28 19:35:04,562 [root] DEBUG: Loader: Injecting process 8996 (thread 9004) with C:\\hsngo5k_\\dll\\gIlsNlf.dll.\n2026-05-28 19:35:04,563 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 19:35:04,564 [root] DEBUG: Successfully injected DLL C:\\hsngo5k_\\dll\\gIlsNlf.dll.\n2026-05-28 19:35:04,565 [lib.api.process] INFO: Injected into 64-bit \n2026-05-28 19:35:04,589 [root] DEBUG: 8996: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-28 19:35:04,590 [root] DEBUG: 8996: Interactive desktop enabled.\n2026-05-28 19:35:04,590 [root] DEBUG: 8996: Dropped file limit defaulting to 100.\n2026-05-28 19:35:04,596 [root] DEBUG: 8996: Disabling sleep skipping.\n2026-05-28 19:35:04,598 [root] DEBUG: 8996: YaraInit: Compiled rules loaded from existing file C:\\hsngo5k_\\data\\yara\\capemon.yac\n2026-05-28 19:35:04,611 [root] DEBUG: 8996: RtlInsertInvertedFunctionTable 0x00007FFBC7B6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFBC7CBD4F0\n2026-05-28 19:35:04,612 [root] DEBUG: 8996: YaraScan: Scanning 0x00007FF69BCF0000, size 0x8026\n2026-05-28 19:35:04,614 [root] DEBUG: 8996: Monitor initialised: 64-bit capemon loaded in process 8996 at 0x00007FFB863A0000, thread 9004, image base 0x00007FF69BCF0000, stack from 0x000000790B0F4000-0x000000790B100000\n2026-05-28 19:35:04,618 [root] DEBUG: 8996: Commandline: C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}\n2026-05-28 19:35:04,630 [root] DEBUG: 8996: hook_api: LdrpCallInitRoutine export address 0x00007FFBC7B699BC obtained via GetFunctionAddress\n2026-05-28 19:35:04,652 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'\n2026-05-28 19:35:04,653 [root] DEBUG: 8996: set_hooks: Unable to hook LockResource\n2026-05-28 19:35:04,658 [root] DEBUG: 8996: Hooked 627 out of 628 functions\n2026-05-28 19:35:04,659 [root] DEBUG: 8996: Syscall hook installed, syscall logging level 1\n2026-05-28 19:35:04,666 [root] DEBUG: 8996: RestoreHeaders: Restored original import table.\n2026-05-28 19:35:04,667 [root] INFO: Loaded monitor into process with pid 8996\n2026-05-28 19:35:04,668 [root] DEBUG: 8996: caller_dispatch: Added region at 0x00007FF69BCF0000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF69BCF12F2, thread 9004).\n2026-05-28 19:35:04,668 [root] DEBUG: 8996: YaraScan: Scanning 0x00007FF69BCF0000, size 0x8026\n2026-05-28 19:35:04,669 [root] DEBUG: 8996: ProcessImageBase: Main module image at 0x00007FF69BCF0000 unmodified (entropy change 0.000000e+00)\n2026-05-28 19:35:04,672 [root] DEBUG: 8996: DLL loaded at 0x00007FFBC3110000: C:\\Windows\\SYSTEM32\\kernel.appcore (0x12000 bytes).\n2026-05-28 19:35:04,675 [root] DEBUG: 8996: DLL loaded at 0x00007FFBC5750000: C:\\Windows\\System32\\bcryptPrimitives (0x82000 bytes).\n2026-05-28 19:35:04,677 [root] DEBUG: 8996: DLL loaded at 0x00007FFBC7A60000: C:\\Windows\\System32\\clbcatq (0xa9000 bytes).\n2026-05-28 19:35:04,691 [root] DEBUG: 8996: DLL loaded at 0x00007FFBC2BF0000: C:\\Windows\\system32\\uxtheme (0x9e000 bytes).\n2026-05-28 19:35:04,706 [root] DEBUG: 8996: DLL loaded at 0x00007FFBC5C20000: C:\\Windows\\System32\\shcore (0xad000 bytes).\n2026-05-28 19:35:04,706 [root] DEBUG: 8996: DLL loaded at 0x00007FFBB0100000: C:\\Windows\\System32\\thumbcache (0x66000 bytes).\n2026-05-28 19:35:04,712 [root] DEBUG: 8996: DLL loaded at 0x00007FFBC0DB0000: C:\\Windows\\system32\\propsys (0xf6000 bytes).\n2026-05-28 19:35:07,182 [root] DEBUG: 4692: DLL loaded at 0x00007FFBB4BE0000: C:\\Windows\\SYSTEM32\\MPR (0x1d000 bytes).\n2026-05-28 19:35:07,205 [root] DEBUG: 4692: DLL loaded at 0x00007FFBC0930000: C:\\Windows\\System32\\drprov (0xb000 bytes).\n2026-05-28 19:35:07,228 [root] DEBUG: 4692: DLL loaded at 0x00007FFBB4AC0000: C:\\Windows\\System32\\ntlanman (0x1f000 bytes).\n2026-05-28 19:35:07,237 [root] DEBUG: 4692: DLL loaded at 0x00007FFBBD8A0000: C:\\Windows\\System32\\DAVHLPR (0xd000 bytes).\n2026-05-28 19:35:07,237 [root] DEBUG: 4692: DLL loaded at 0x00007FFBB4500000: C:\\Windows\\System32\\davclnt (0x1e000 bytes).\n2026-05-28 19:35:07,260 [root] DEBUG: 4692: DLL loaded at 0x00007FFB6CFF0000: C:\\Windows\\System32\\PlayToDevice (0x64000 bytes).\n2026-05-28 19:35:07,274 [root] DEBUG: 4692: DLL loaded at 0x00007FFBB2520000: C:\\Windows\\System32\\EhStorAPI (0x26000 bytes).\n2026-05-28 19:35:09,300 [root] DEBUG: 4692: AllocationHandler: Allocation already in tracked region list: 0x00007DF4C7560000.\n2026-05-28 19:35:09,301 [root] DEBUG: 4692: AllocationHandler: Allocation already in tracked region list: 0x00007DF4C7550000.\n2026-05-28 19:35:09,302 [root] DEBUG: 4692: AllocationHandler: Allocation already in tracked region list: 0x00007DF4C7540000.\n2026-05-28 19:35:09,303 [root] DEBUG: 4692: AllocationHandler: Allocation already in tracked region list: 0x00007DF4C7530000.\n2026-05-28 19:35:09,325 [root] DEBUG: 844: CreateProcessHandler: Injection info set for new process 8836: C:\\Windows\\SystemApps\\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\\CHXSmartScreen.exe, ImageBase: 0x00007FF630AD0000\n2026-05-28 19:35:09,326 [root] INFO: Announced 64-bit process name: CHXSmartScreen.exe pid: 8836\n2026-05-28 19:35:09,326 [lib.api.process] INFO: Monitor config for process 8836: C:\\hsngo5k_\\dll\\8836.ini\n2026-05-28 19:35:09,329 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 19:35:09,332 [lib.api.process] INFO: 64-bit DLL to inject is C:\\hsngo5k_\\dll\\gIlsNlf.dll, loader C:\\hsngo5k_\\bin\\vouhCgRr.exe\n2026-05-28 19:35:09,337 [root] DEBUG: Loader: Injecting process 8836 (thread 10052) with C:\\hsngo5k_\\dll\\gIlsNlf.dll.\n2026-05-28 19:35:09,337 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 19:35:09,338 [root] DEBUG: Successfully injected DLL C:\\hsngo5k_\\dll\\gIlsNlf.dll.\n2026-05-28 19:35:09,340 [lib.api.process] INFO: Injected into 64-bit \n2026-05-28 19:35:09,341 [root] INFO: Announced 64-bit process name: CHXSmartScreen.exe pid: 8836\n2026-05-28 19:35:09,342 [lib.api.process] INFO: Monitor config for process 8836: C:\\hsngo5k_\\dll\\8836.ini\n2026-05-28 19:35:09,342 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 19:35:09,344 [lib.api.process] INFO: 64-bit DLL to inject is C:\\hsngo5k_\\dll\\gIlsNlf.dll, loader C:\\hsngo5k_\\bin\\vouhCgRr.exe\n2026-05-28 19:35:09,348 [root] DEBUG: Loader: Injecting process 8836 (thread 10052) with C:\\hsngo5k_\\dll\\gIlsNlf.dll.\n2026-05-28 19:35:09,349 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 19:35:09,350 [root] DEBUG: Successfully injected DLL C:\\hsngo5k_\\dll\\gIlsNlf.dll.\n2026-05-28 19:35:09,351 [lib.api.process] INFO: Injected into 64-bit \n2026-05-28 19:35:09,352 [root] INFO: Announced 64-bit process name: CHXSmartScreen.exe pid: 8836\n2026-05-28 19:35:09,354 [lib.api.process] INFO: Monitor config for process 8836: C:\\hsngo5k_\\dll\\8836.ini\n2026-05-28 19:35:09,354 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 19:35:09,356 [lib.api.process] INFO: 64-bit DLL to inject is C:\\hsngo5k_\\dll\\gIlsNlf.dll, loader C:\\hsngo5k_\\bin\\vouhCgRr.exe\n2026-05-28 19:35:09,362 [root] DEBUG: Loader: Injecting process 8836 with C:\\hsngo5k_\\dll\\gIlsNlf.dll.\n2026-05-28 19:35:09,363 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 10052, handle 0x120\n2026-05-28 19:35:09,363 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 19:35:09,364 [root] DEBUG: Successfully injected DLL C:\\hsngo5k_\\dll\\gIlsNlf.dll.\n2026-05-28 19:35:09,365 [lib.api.process] INFO: Injected into 64-bit \n2026-05-28 19:35:12,406 [root] INFO: Process with pid 8996 has terminated\n2026-05-28 19:35:12,407 [root] DEBUG: 8996: NtTerminateProcess hook: Attempting to dump process 8996\n2026-05-28 19:35:12,408 [root] DEBUG: 8996: DoProcessDump: Skipping process dump as code is identical on disk.\n", "errors": [] }, "network": { "pcap_sha256": "c9991ef103c31ce6362c51ff0536d8a119912ef0da307b827f6618ec22fa720a", "hosts": [ { "ip": "23.202.166.56", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "162.159.137.232", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "162.159.130.235", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "latency.discord.media", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "199.232.83.82", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "150.171.109.17", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "199.232.210.172", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 80 ] }, { "ip": "23.202.165.215", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "23.216.117.82", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 80 ] }, { "ip": "40.115.75.193", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "199.232.215.52", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "23.211.129.205", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "162.159.135.234", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "gateway-us-east1-d.discord.gg", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "199.232.211.52", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "13.107.246.31", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "23.216.106.59", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "162.159.128.235", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "latency.discord.media", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "185.247.139.200", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "badoomovies.com", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "149.135.84.155", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 80 ] }, { "ip": "162.159.134.233", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "103.10.125.22", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 27018 ] }, { "ip": "172.172.255.216", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "162.254.194.57", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 27018 ] }, { "ip": "162.254.195.75", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 27018 ] }, { "ip": "162.254.195.69", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "103.10.125.23", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 27018 ] }, { "ip": "162.159.133.233", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] } ], "domains": [ { "domain": "badoomovies.com", "ip": "185.247.139.200" }, { "domain": "latency.discord.media", "ip": "162.159.129.235" }, { "domain": "dns.google", "ip": "8.8.8.8" }, { "domain": "disabled.invalid", "ip": "" }, { "domain": "gateway-us-east1-d.discord.gg", "ip": "162.159.130.234" }, { "domain": "p2p-syd1.discovery.steamserver.net", "ip": "103.10.125.42" } ], "tcp": [ { "src": "103.10.125.23", "sport": 27018, "dst": "192.168.1.105", "dport": 49700, "offset": 570, "time": 0.04103708267211914 }, { "src": "103.10.125.23", "sport": 443, "dst": "192.168.1.105", "dport": 49699, "offset": 804, "time": 0.04227018356323242 }, { "src": "162.254.195.69", "sport": 443, "dst": "192.168.1.105", "dport": 49702, "offset": 2410, "time": 0.4868309497833252 }, { "src": "162.254.195.75", "sport": 27018, "dst": "192.168.1.105", "dport": 49704, "offset": 2714, "time": 0.6055841445922852 }, { "src": "162.254.195.69", "sport": 27018, "dst": "192.168.1.105", "dport": 49703, "offset": 2948, "time": 0.6070711612701416 }, { "src": "162.254.194.57", "sport": 27018, "dst": "192.168.1.105", "dport": 49705, "offset": 4078, "time": 0.9551520347595215 }, { "src": "192.168.1.105", "sport": 49726, "dst": "172.172.255.216", "dport": 443, "offset": 4616, "time": 1.1947691440582275 }, { "src": "103.10.125.22", "sport": 27018, "dst": "192.168.1.105", "dport": 49701, "offset": 16270, "time": 2.7743489742279053 }, { "src": "192.168.1.105", "sport": 49728, "dst": "23.209.40.176", "dport": 443, "offset": 17973, "time": 5.6633219718933105 }, { "src": "192.168.1.105", "sport": 49729, "dst": "162.159.133.233", "dport": 443, "offset": 24778, "time": 6.439125061035156 }, { "src": "192.168.1.105", "sport": 49732, "dst": "162.159.134.233", "dport": 443, "offset": 79120, "time": 13.013265132904053 }, { "src": "192.168.1.105", "sport": 49735, "dst": "52.123.252.238", "dport": 443, "offset": 94648, "time": 13.740755081176758 }, { "src": "192.168.1.105", "sport": 49739, "dst": "23.209.40.171", "dport": 443, "offset": 99600, "time": 13.757593154907227 }, { "src": "192.168.1.105", "sport": 49742, "dst": "185.247.139.200", "dport": 443, "offset": 153605, "time": 14.452800989151001 }, { "src": "192.168.1.105", "sport": 49743, "dst": "162.159.128.235", "dport": 443, "offset": 160267, "time": 14.928591966629028 }, { "src": "192.168.1.105", "sport": 49745, "dst": "150.171.28.11", "dport": 443, "offset": 234424, "time": 15.381915092468262 }, { "src": "23.216.106.59", "sport": 443, "dst": "192.168.1.105", "dport": 49698, "offset": 298361, "time": 15.84118914604187 }, { "src": "192.168.1.105", "sport": 49750, "dst": "52.123.252.238", "dport": 443, "offset": 378399, "time": 16.40120506286621 }, { "src": "192.168.1.105", "sport": 49755, "dst": "172.64.41.3", "dport": 443, "offset": 4896750, "time": 18.544636964797974 }, { "src": "192.168.1.105", "sport": 49754, "dst": "8.8.8.8", "dport": 443, "offset": 4913870, "time": 18.555773973464966 }, { "src": "192.168.1.105", "sport": 49757, "dst": "8.8.4.4", "dport": 443, "offset": 4927585, "time": 18.56941795349121 }, { "src": "23.216.106.59", "sport": 443, "dst": "192.168.1.105", "dport": 49715, "offset": 5174855, "time": 18.830058097839355 }, { "src": "23.216.106.59", "sport": 443, "dst": "192.168.1.105", "dport": 49717, "offset": 7914207, "time": 18.956109046936035 }, { "src": "23.216.106.59", "sport": 443, "dst": "192.168.1.105", "dport": 49716, "offset": 7914371, "time": 18.956156015396118 }, { "src": "13.107.246.31", "sport": 443, "dst": "192.168.1.105", "dport": 49689, "offset": 28287578, "time": 21.78204917907715 }, { "src": "192.168.1.105", "sport": 49724, "dst": "199.232.211.52", "dport": 443, "offset": 37051355, "time": 22.952367067337036 }, { "src": "192.168.1.105", "sport": 49692, "dst": "162.159.135.234", "dport": 443, "offset": 49787991, "time": 24.79352903366089 }, { "src": "192.168.1.105", "sport": 49758, "dst": "162.159.135.234", "dport": 443, "offset": 60833799, "time": 26.134968996047974 }, { "src": "192.168.1.105", "sport": 49709, "dst": "162.159.61.3", "dport": 443, "offset": 102554576, "time": 31.992021083831787 }, { "src": "192.168.1.105", "sport": 49708, "dst": "8.8.4.4", "dport": 443, "offset": 104378753, "time": 32.06931209564209 }, { "src": "192.168.1.105", "sport": 49718, "dst": "23.211.129.205", "dport": 443, "offset": 119371705, "time": 34.07184410095215 }, { "src": "192.168.1.105", "sport": 49720, "dst": "23.216.106.59", "dport": 443, "offset": 119722086, "time": 34.164751052856445 }, { "src": "192.168.1.105", "sport": 49719, "dst": "199.232.211.52", "dport": 443, "offset": 125608600, "time": 35.11847996711731 }, { "src": "192.168.1.105", "sport": 49722, "dst": "199.232.215.52", "dport": 443, "offset": 131443983, "time": 36.22671818733215 }, { "src": "192.168.1.105", "sport": 49721, "dst": "23.211.129.205", "dport": 443, "offset": 131444136, "time": 36.48437213897705 }, { "src": "192.168.1.105", "sport": 49723, "dst": "23.216.106.59", "dport": 443, "offset": 131444289, "time": 36.706950187683105 }, { "src": "192.168.1.105", "sport": 49759, "dst": "40.115.75.193", "dport": 443, "offset": 131455738, "time": 36.77647304534912 }, { "src": "23.202.165.215", "sport": 443, "dst": "192.168.1.105", "dport": 49677, "offset": 131481951, "time": 37.404293060302734 }, { "src": "192.168.1.105", "sport": 49760, "dst": "150.171.109.17", "dport": 443, "offset": 131485939, "time": 43.42231202125549 }, { "src": "199.232.83.82", "sport": 443, "dst": "192.168.1.105", "dport": 49754, "offset": 131515457, "time": 44.42103600502014 }, { "src": "192.168.1.105", "sport": 49762, "dst": "40.115.75.193", "dport": 443, "offset": 131516065, "time": 44.52257204055786 }, { "src": "192.168.1.105", "sport": 49766, "dst": "150.171.27.11", "dport": 443, "offset": 131563369, "time": 46.59404015541077 }, { "src": "192.168.1.105", "sport": 49768, "dst": "150.171.27.11", "dport": 443, "offset": 131605137, "time": 46.83613204956055 }, { "src": "192.168.1.105", "sport": 49773, "dst": "172.64.41.3", "dport": 443, "offset": 131671132, "time": 51.59084701538086 }, { "src": "192.168.1.105", "sport": 49772, "dst": "8.8.4.4", "dport": 443, "offset": 131691793, "time": 51.60086107254028 }, { "src": "162.159.130.235", "sport": 443, "dst": "192.168.1.105", "dport": 49738, "offset": 131743805, "time": 55.044363021850586 }, { "src": "192.168.1.105", "sport": 49675, "dst": "172.172.255.216", "dport": 443, "offset": 131770070, "time": 73.3378701210022 }, { "src": "23.202.166.56", "sport": 443, "dst": "192.168.1.105", "dport": 49820, "offset": 131770775, "time": 76.52146315574646 } ], "udp": [ { "src": "192.168.1.105", "sport": 63605, "dst": "162.159.133.233", "dport": 443, "offset": 24, "time": 0.0 }, { "src": "192.168.1.105", "sport": 55106, "dst": "162.159.134.233", "dport": 443, "offset": 35080, "time": 6.520620107650757 }, { "src": "192.168.1.105", "sport": 65293, "dst": "8.8.8.8", "dport": 53, "offset": 88141, "time": 13.692738056182861 }, { "src": "192.168.1.105", "sport": 50763, "dst": "8.8.8.8", "dport": 53, "offset": 88329, "time": 13.69324803352356 }, { "src": "192.168.1.105", "sport": 49886, "dst": "8.8.8.8", "dport": 53, "offset": 88651, "time": 13.698906183242798 }, { "src": "192.168.1.105", "sport": 52299, "dst": "8.8.8.8", "dport": 53, "offset": 90553, "time": 13.70924711227417 }, { "src": "192.168.1.105", "sport": 50105, "dst": "8.8.8.8", "dport": 53, "offset": 91319, "time": 13.71918797492981 }, { "src": "192.168.1.105", "sport": 51800, "dst": "8.8.8.8", "dport": 53, "offset": 96633, "time": 13.743911027908325 }, { "src": "192.168.1.105", "sport": 56970, "dst": "8.8.8.8", "dport": 53, "offset": 159435, "time": 14.879842042922974 }, { "src": "192.168.1.105", "sport": 27036, "dst": "192.168.1.255", "dport": 27036, "offset": 168611, "time": 15.026394128799438 }, { "src": "192.168.1.105", "sport": 60090, "dst": "23.209.40.171", "dport": 443, "offset": 209034, "time": 15.296732187271118 }, { "src": "192.168.1.105", "sport": 53129, "dst": "185.247.139.200", "dport": 443, "offset": 211650, "time": 15.300537109375 }, { "src": "192.168.1.105", "sport": 5353, "dst": "224.0.0.251", "dport": 5353, "offset": 298945, "time": 15.989873170852661 }, { "src": "192.168.1.105", "sport": 55891, "dst": "8.8.8.8", "dport": 53, "offset": 4861547, "time": 18.494474172592163 }, { "src": "192.168.1.105", "sport": 54792, "dst": "8.8.8.8", "dport": 53, "offset": 4861719, "time": 18.494994163513184 }, { "src": "192.168.1.105", "sport": 54045, "dst": "8.8.8.8", "dport": 53, "offset": 4861921, "time": 18.495373964309692 }, { "src": "192.168.1.105", "sport": 52764, "dst": "8.8.8.8", "dport": 53, "offset": 4862093, "time": 18.495689153671265 }, { "src": "192.168.1.105", "sport": 53693, "dst": "8.8.8.8", "dport": 53, "offset": 4862295, "time": 18.49601101875305 }, { "src": "192.168.1.105", "sport": 59451, "dst": "8.8.8.8", "dport": 53, "offset": 4862467, "time": 18.4962899684906 }, { "src": "192.168.1.105", "sport": 60153, "dst": "8.8.4.4", "dport": 443, "offset": 4863857, "time": 18.520069122314453 }, { "src": "192.168.1.105", "sport": 58390, "dst": "172.64.41.3", "dport": 443, "offset": 4869662, "time": 18.53394317626953 }, { "src": "192.168.1.105", "sport": 64604, "dst": "8.8.4.4", "dport": 443, "offset": 8995513, "time": 19.251845121383667 }, { "src": "192.168.1.105", "sport": 52888, "dst": "8.8.8.8", "dport": 53, "offset": 10754373, "time": 19.406877994537354 }, { "src": "192.168.1.105", "sport": 61206, "dst": "8.8.8.8", "dport": 53, "offset": 10755242, "time": 19.430605173110962 }, { "src": "192.168.1.105", "sport": 138, "dst": "192.168.1.255", "dport": 138, "offset": 49141248, "time": 24.66087317466736 }, { "src": "192.168.1.105", "sport": 50838, "dst": "8.8.8.8", "dport": 53, "offset": 60615490, "time": 26.08505606651306 }, { "src": "192.168.1.105", "sport": 52032, "dst": "23.209.40.171", "dport": 443, "offset": 131545893, "time": 46.04838514328003 }, { "src": "192.168.1.105", "sport": 52003, "dst": "8.8.8.8", "dport": 53, "offset": 131559897, "time": 46.55821204185486 }, { "src": "192.168.1.105", "sport": 61364, "dst": "8.8.8.8", "dport": 53, "offset": 131560085, "time": 46.56430411338806 }, { "src": "192.168.1.105", "sport": 53894, "dst": "8.8.8.8", "dport": 53, "offset": 131622494, "time": 49.6192991733551 }, { "src": "192.168.1.105", "sport": 61522, "dst": "23.209.40.176", "dport": 443, "offset": 131623181, "time": 49.64555311203003 }, { "src": "192.168.1.105", "sport": 51588, "dst": "8.8.8.8", "dport": 53, "offset": 131639237, "time": 51.556735038757324 }, { "src": "192.168.1.105", "sport": 59105, "dst": "8.8.8.8", "dport": 53, "offset": 131639424, "time": 51.55696415901184 }, { "src": "192.168.1.105", "sport": 50302, "dst": "8.8.8.8", "dport": 53, "offset": 131639611, "time": 51.55718016624451 }, { "src": "192.168.1.105", "sport": 60665, "dst": "8.8.8.8", "dport": 53, "offset": 131639798, "time": 51.55737900733948 }, { "src": "192.168.1.105", "sport": 53981, "dst": "8.8.8.8", "dport": 53, "offset": 131639985, "time": 51.55756497383118 }, { "src": "192.168.1.105", "sport": 63856, "dst": "8.8.8.8", "dport": 53, "offset": 131640172, "time": 51.5577449798584 }, { "src": "192.168.1.105", "sport": 59070, "dst": "162.159.61.3", "dport": 443, "offset": 131644793, "time": 51.58006811141968 }, { "src": "192.168.1.105", "sport": 63272, "dst": "172.64.41.3", "dport": 443, "offset": 131650199, "time": 51.58271098136902 } ], "icmp": [ { "src": "192.168.1.105", "dst": "8.8.4.4", "type": 3, "data": "" } ], "http": [], "dns": [ { "request": "badoomovies.com", "type": "A", "answers": [ { "type": "A", "data": "185.247.139.200" } ], "first_seen": 1779996869.390648 }, { "request": "latency.discord.media", "type": "A", "answers": [ { "type": "A", "data": "162.159.128.235" }, { "type": "A", "data": "162.159.138.234" }, { "type": "A", "data": "162.159.137.234" }, { "type": "A", "data": "162.159.130.235" }, { "type": "A", "data": "162.159.129.235" } ], "first_seen": 1779996870.577158 }, { "request": "dns.google", "type": "A", "answers": [ { "type": "A", "data": "8.8.4.4" }, { "type": "A", "data": "8.8.8.8" } ], "first_seen": 1779996874.192021 }, { "request": "disabled.invalid", "type": "A", "answers": [ { "type": "NXDOMAIN", "data": "" } ], "first_seen": 1779996875.104194 }, { "request": "gateway-us-east1-d.discord.gg", "type": "A", "answers": [ { "type": "A", "data": "162.159.133.234" }, { "type": "A", "data": "162.159.134.234" }, { "type": "A", "data": "162.159.130.234" }, { "type": "A", "data": "162.159.135.234" }, { "type": "A", "data": "162.159.136.234" } ], "first_seen": 1779996881.781456 }, { "request": "p2p-syd1.discovery.steamserver.net", "type": "A", "answers": [ { "type": "A", "data": "103.10.125.24" }, { "type": "A", "data": "103.10.125.42" } ], "first_seen": 1779996902.5037 } ], "smtp": [], "irc": [], "dead_hosts": [ [ "192.168.1.1", 9000 ], [ "199.232.83.82", 443 ] ] }, "url": { "whois": "Name: None\nCountry: None\nState: None\nCity: None\nZIP Code: None\nAddress: None\n\nOrginization: None\nDomain Name(s):\n BADOOMOVIES.COM\nCreation Date:\n 2026-05-26 15:06:50\nUpdated Date:\n 2026-05-26 16:54:14\nExpiration Date:\n 2027-05-26 15:06:50\nEmail(s):\n abuse-tracker@hostinger.com\n\nRegistrar(s):\n HOSTINGER operations, UAB\nName Server(s):\n DNS23.HOSTWARE.COM.TR\n DNS24.HOSTWARE.COM.TR\nReferral URL(s):\n None", "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" } }, "target": { "category": "url" }, "url_analysis": { "url": "https://badoomovies.com/download/BadooMovies.exe" }, "procmemory": [], "signatures": [ { "name": "stealth_network", "description": "Network activity detected but not expressed in monitor API logs", "categories": [ "stealth" ], "severity": 1, "weight": 1, "confidence": 100, "references": [], "data": [ { "ip": "23.202.166.56" }, { "ip": "162.159.137.232" }, { "ip": "162.159.130.235" }, { "ip": "199.232.83.82" }, { "ip": "150.171.109.17" }, { "ip": "199.232.210.172" }, { "ip": "23.202.165.215" }, { "ip": "23.216.117.82" }, { "ip": "40.115.75.193" }, { "ip": "199.232.215.52" }, { "ip": "23.211.129.205" }, { "ip": "162.159.135.234" }, { "ip": "199.232.211.52" }, { "ip": "13.107.246.31" }, { "ip": "23.216.106.59" }, { "ip": "162.159.128.235" }, { "ip": "185.247.139.200" }, { "ip": "149.135.84.155" }, { "ip": "162.159.134.233" }, { "ip": "103.10.125.22" }, { "ip": "172.172.255.216" }, { "ip": "162.254.194.57" }, { "ip": "162.254.195.75" }, { "ip": "162.254.195.69" }, { "ip": "103.10.125.23" }, { "ip": "162.159.133.233" }, { "domain": "badoomovies.com" }, { "domain": "latency.discord.media" }, { "domain": "dns.google" }, { "domain": "disabled.invalid" }, { "domain": "gateway-us-east1-d.discord.gg" }, { "domain": "p2p-syd1.discovery.steamserver.net" } ], "new_data": [], "alert": false, "families": [] }, { "name": "queries_keyboard_layout", "description": "Queries the keyboard layout", "categories": [ "location_discovery" ], "severity": 1, "weight": 1, "confidence": 100, "references": [], "data": [ { "type": "call", "pid": 8996, "cid": 964 } ], "new_data": [], "alert": false, "families": [] }, { "name": "accesses_public_folder", "description": "A file was accessed within the Public folder.", "categories": [ "generic" ], "severity": 1, "weight": 1, "confidence": 100, "references": [], "data": [ { "file": "C:\\Users\\Public\\Desktop\\desktop.ini" }, { "file": "C:\\Users\\Public\\Desktop" } ], "new_data": [], "alert": false, "families": [] }, { "name": "antidebug_setunhandledexceptionfilter", "description": "SetUnhandledExceptionFilter detected (possible anti-debug)", "categories": [ "anti-debug" ], "severity": 1, "weight": 1, "confidence": 40, "references": [], "data": [ { "type": "call", "pid": 9452, "cid": 165 } ], "new_data": [], "alert": false, "families": [] }, { "name": "stealth_timeout", "description": "Possible date expiration check, exits too soon after checking local time", "categories": [ "stealth" ], "severity": 1, "weight": 1, "confidence": 40, "references": [], "data": [ { "process": "dllhost.exe, PID 8996" }, { "type": "call", "pid": 8996, "cid": 974 } ], "new_data": [], "alert": false, "families": [] }, { "name": "language_check_registry", "description": "Checks system language via registry key (possible geofencing)", "categories": [ "location_discovery", "geofence" ], "severity": 1, "weight": 1, "confidence": 100, "references": [], "data": [ { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-AU" }, { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-AU" } ], "new_data": [], "alert": false, "families": [] }, { "name": "privilege_elevation_check", "description": "Queries process token information to check for Administrator privileges or UAC elevation status", "categories": [ "discovery", "privilege_escalation" ], "severity": 2, "weight": 1, "confidence": 80, "references": [], "data": [ { "type": "call", "pid": 9452, "cid": 3862 }, { "type": "call", "pid": 9452, "cid": 3863 }, { "type": "call", "pid": 9452, "cid": 4146 }, { "type": "call", "pid": 9452, "cid": 4147 }, { "type": "call", "pid": 9452, "cid": 4483 }, { "type": "call", "pid": 9452, "cid": 4484 }, { "type": "call", "pid": 8996, "cid": 68 }, { "type": "call", "pid": 8996, "cid": 69 }, { "type": "call", "pid": 8996, "cid": 166 }, { "type": "call", "pid": 8996, "cid": 167 } ], "new_data": [], "alert": false, "families": [] }, { "name": "query_fips_reconnaissance", "description": "Queried the FIPS cryptography policy, can be used to adapt C2 network encryption or by legitimate encryption software", "categories": [ "discovery", "c2" ], "severity": 2, "weight": 1, "confidence": 50, "references": [], "data": [ { "type": "call", "pid": 8996, "cid": 48 }, { "type": "call", "pid": 8996, "cid": 49 }, { "type": "call", "pid": 8996, "cid": 52 }, { "type": "call", "pid": 8996, "cid": 54 }, { "type": "call", "pid": 8996, "cid": 55 }, { "behavioral_fips_reconnaissance": [ "dllhost.exe (PID: 8996) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE'", "dllhost.exe (PID: 8996) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy'", "dllhost.exe (PID: 8996) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled'", "dllhost.exe (PID: 8996) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy'", "dllhost.exe (PID: 8996) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled'" ] } ], "new_data": [], "alert": false, "families": [] }, { "name": "mountpoints_volume_discovery", "description": "Queries the mount points and then resolves volume paths to enumerate storage devices", "categories": [ "discovery", "ransomware", "wiper" ], "severity": 2, "weight": 1, "confidence": 20, "references": [], "data": [ { "type": "call", "pid": 9452, "cid": 4071 }, { "type": "call", "pid": 9452, "cid": 4076 }, { "type": "call", "pid": 9452, "cid": 4089 }, { "type": "call", "pid": 9452, "cid": 4183 }, { "type": "call", "pid": 9452, "cid": 4196 }, { "type": "call", "pid": 9452, "cid": 4208 }, { "type": "call", "pid": 9452, "cid": 4218 }, { "type": "call", "pid": 9452, "cid": 4232 } ], "new_data": [], "alert": false, "families": [] }, { "name": "dllload_suspicious_directory", "description": "A DLL was loaded from a suspicious directory", "categories": [ "side loading" ], "severity": 2, "weight": 1, "confidence": 50, "references": [], "data": [ { "type": "call", "pid": 5704, "cid": 123 }, { "suspicious_dll_load": "Process msedge.exe loaded a DLL from a suspicious directory, this is possibly indicative of DLL side loading/search order hijacking" } ], "new_data": [], "alert": false, "families": [] }, { "name": "registers_vectored_exception_handler", "description": "Registers a vectored exception handler (VEH), possibly to hijack execution flow", "categories": [ "evasion", "execution", "injection" ], "severity": 2, "weight": 1, "confidence": 80, "references": [], "data": [ { "type": "call", "pid": 9452, "cid": 166 } ], "new_data": [], "alert": false, "families": [] }, { "name": "creates_suspended_process", "description": "Creates a process in a suspended state, likely for injection", "categories": [ "injection", "process hollowing" ], "severity": 2, "weight": 1, "confidence": 50, "references": [], "data": [ { "type": "call", "pid": 5704, "cid": 104 }, { "type": "call", "pid": 5704, "cid": 106 }, { "type": "call", "pid": 5704, "cid": 119 }, { "type": "call", "pid": 5704, "cid": 120 }, { "type": "call", "pid": 5704, "cid": 139 }, { "type": "call", "pid": 5704, "cid": 140 }, { "type": "call", "pid": 5704, "cid": 159 }, { "type": "call", "pid": 5704, "cid": 160 }, { "type": "call", "pid": 844, "cid": 9 }, { "type": "call", "pid": 844, "cid": 78 } ], "new_data": [], "alert": false, "families": [] }, { "name": "resumethread_remote_process", "description": "Resumed a thread in another process", "categories": [ "injection", "unpacking" ], "severity": 2, "weight": 1, "confidence": 100, "references": [], "data": [ { "thread_resumed": "Process svchost.exe with process ID 844 resumed a thread in another process with the process ID 4404" }, { "type": "call", "pid": 844, "cid": 10 } ], "new_data": [], "alert": false, "families": [] }, { "name": "accesses_recyclebin", "description": "Manipulates data from or to the Recycle Bin", "categories": [ "evasion", "execution" ], "severity": 2, "weight": 1, "confidence": 100, "references": [], "data": [ { "type": "call", "pid": 4692, "cid": 3014 }, { "type": "call", "pid": 4692, "cid": 3016 }, { "file": "C:\\$Recycle.Bin\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "file": "C:\\$Recycle.Bin\\S-1-5-21-3968686040-3210279463-847977608-1001\\desktop.ini" } ], "new_data": [], "alert": false, "families": [] }, { "name": "discover_registry_mount_points", "description": "Queries registry mount points to identify historical or connected removable/network drives", "categories": [ "discovery", "ransomware", "wiper" ], "severity": 2, "weight": 1, "confidence": 20, "references": [], "data": [ { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Generation" }, { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Data" }, { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" }, { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\" }, { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" }, { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Data" }, { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\" } ], "new_data": [], "alert": false, "families": [] }, { "name": "suspicious_tld", "description": "Resolves a suspicious Top Level Domain (TLD)", "categories": [ "network" ], "severity": 2, "weight": 1, "confidence": 100, "references": [], "data": [ { "domain": "latency.discord.media" } ], "new_data": [], "alert": false, "families": [] }, { "name": "antisandbox_unhook", "description": "Tries to unhook or modify Windows functions monitored by CAPE", "categories": [ "anti-sandbox" ], "severity": 3, "weight": 1, "confidence": 60, "references": [], "data": [ { "type": "call", "pid": 9452, "cid": 2319 }, { "unhook": "function_name: CommandLineToArgvW, type: restored" } ], "new_data": [], "alert": false, "families": [] } ], "malscore": 10.0, "ttps": [ { "signature": "antisandbox_unhook", "ttps": [ "T1562.001", "T1562" ], "mbcs": [ "OB0001", "B0003", "OB0006", "F0004", "F0004.003" ] }, { "signature": "privilege_elevation_check", "ttps": [ "T1033", "T1082" ], "mbcs": [ "OC0006", "C0002" ] }, { "signature": "query_fips_reconnaissance", "ttps": [ "T1082" ], "mbcs": [ "OC0006", "C0002" ] }, { "signature": "mountpoints_volume_discovery", "ttps": [ "T1082" ], "mbcs": [ "OC0006", "C0002" ] }, { "signature": "dllload_suspicious_directory", "ttps": [ "T1574" ], "mbcs": [ "F0015" ] }, { "signature": "registers_vectored_exception_handler", "ttps": [ "T1055", "T1574" ], "mbcs": [ "OC0006", "C0002" ] }, { "signature": "creates_suspended_process", "ttps": [ "T1055" ], "mbcs": [ "OC0006", "C0002" ] }, { "signature": "resumethread_remote_process", "ttps": [ "T1055" ], "mbcs": [ "OC0006", "C0002" ] }, { "signature": "accesses_recyclebin", "ttps": [ "T1074" ], "mbcs": [ "OC0006", "C0002" ] }, { "signature": "accesses_public_folder", "ttps": [ "T1548", "T1036" ], "mbcs": [] }, { "signature": "discover_registry_mount_points", "ttps": [ "T1082" ], "mbcs": [ "OC0006", "C0002" ] }, { "signature": "suspicious_tld", "ttps": [ "T1071" ], "mbcs": [ "OC0006", "C0002" ] } ], "malstatus": "Malicious" }